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EXECUTIVE  SUMMARY 


This  study  is  a  qualitative  assessment  of  current  incident  management  doctrine. 
Amongst  the  various  sources  of  foundational  doctrine  guiding  the  disciplines  and  the 
practitioners  that  compose  the  incident  management  enterprise  a  number  of 
inconsistencies,  gaps,  redundancies,  and  obfuscations  can  be  found  that  negatively  impact 
the  interoperability,  the  response  efficacy,  the  conceptual  understanding,  and  the  potential 
positive  growth  of  the  enterprise.  This  study  is  divided  into  various  sections  consisting  of 
discovery  and  analysis,  synthesis,  application,  and  findings. 

The  discovery  and  analysis  section  consists  of  practitioner  interviews  and  an  in- 
depth  incident  management  literature  review.  The  synthesis  section  consists  of  a  proposal 
for  a  new  model  for  the  conceptual  understanding  of  incident  management  that  attempts 
to  resolve  and  deconflict  findings  identified  in  the  analysis  section.  The  synthesis 
section’s  proposed  model  consists  of  a  rectified  comprehensive  lexicon  with  definitions 
and  justifications,  as  well  as  conceptual  diagrams  with  narrative  descriptions  that  serve  to 
illustrate  various  components  of  the  incident  management  enterprise,  system,  and 
process.  The  synthesis  section  and  output  is  followed  by  an  application  section  where  the 
proposed  conceptual  model  is  applied  to  four  case  examples  (a  major  Stafford  Act  event, 
a  non-Stafford  Act  event,  a  domestic  terrorist  non-Stafford  Act  event,  and  an  off-shore 
non-Stafford  Act  event),  which  serves  to  help  illustrate  the  applicability  of  the  proposed 
conceptual  model.  The  application  section  is  then  followed  by  conclusion  and 
implementation  sections.  These  sections  outline  the  major  findings  related  to  incident 
management  as  an  enterprise,  system,  and  a  process  that  have  been  identified  and 
discovered  throughout  the  various  sections  of  this  study,  as  well  as  recommended 
implementation  measures  for  the  synthesis  output’s  proposed  conceptual  model  that 
might  serve  to  address  the  findings  outlined  in  the  conclusions  section. 

While  the  proposed  lexicon  and  conceptual  model  is  the  primary  output  of  this 
thesis,  several  major  findings  and  conclusions  related  to  incident  management  are  made. 
The  conclusions  can  broadly  be  categorized  as  doctrinal  literature  findings.  Within  the 

conclusions  are  two  main  topic  areas,  the  first  of  which  is  specific  to  the  relationship 
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between  crisis  philosophy,  the  operational  movement  of  resources,  and  the  role  of 
Department  Operations  Centers.  The  second  topic  area  is  related  to  deficiencies  in 
existing  foundational  term  and  concept  definitions. 

In  addition  to  the  previously  identified  findings  and  conclusions,  a  number  of 
recommended  implementation  measures  for  the  proposed  conceptual  model  are  suggested 
that  might  serve  to  address  these  findings  and  conclusions.  The  implementation  measures 
and  broad  incident  management  enterprise  recommendations  are  correlated  to  the  primary 
conclusions  categories. 
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I. 


INTRODUCTION 


When  considering  incident  management,  whether  as  an  enterprise,  an  endeavor,  a 
system,  an  action,  or  an  organizational  model,  it  can  in  all  cases  be  considered  a  tool  for 
sense  making.  It  allows  practitioners  to  understand  how  to  organize  and  act 
collaboratively  to  effect  or  create  order  from  disorder.  Any  sense  making  tool  is  simply 
an  idea  that  describes  the  relationships  between  what  exists  and  the  observers  to  form  an 
organized  pattern  of  thought  that  informs  a  paradigm  of  comprehension  about  their  place 
within  that  world,  system,  or  phenomena,  and  informs  action.  How  one  person  applies  a 
given  sense  making  tool,  or  idea,  may  be  different  than  the  next  person  depending  on 
how  complete  or  granular  the  idea  is,  thus  affecting  paradigms  differently.  It  could  be 
said  then  (and  has  been  said  by  Robert  de  Neufville  in  his  description  of  John  Dewey’ s 
instrumentalism)  that  “the  value  of  any  idea  is  determined  by  its  usefulness  in  helping 
people  to  adapt  to  the  world  around  them.” 1 

Based  on  the  aforementioned  description,  if  people  have  trouble  adapting  to  the 
world ,  system,  or  phenomena  that  an  idea  is  intended  to  describe  then  either  their 
understanding  of  the  idea  is  flawed,  or  the  idea  itself  is  incomplete  or  flawed.  In  relation 
to  this  study’s  topic,  incident  management  as  a  conceptual  model,  the  “idea”  is  incident 
management,  and  the  “world”  is  the  enterprise  of  collaborative  disciplines,  functions,  and 
organizations;  the  “system”  is  the  processes  of  collaboration  defined  in  the  doctrine;  and 
the  “phenomena”  are  the  various  types  of  incidents  being  managed.  However,  whether  it 
is  arguments  about  Emergency  Operations  Center  (EOC)  vest  colors,  or  confusion  about 
the  role  of  Department  Operations  Centers  (DOCs),  or  inconsistencies  in  the  action 
planning  process  across  the  nation,  or  confusion  by  some  disciplines  about  the  purpose  or 
function  of  other  disciplines,  or  the  confusion  about  the  differences  between  protection  or 
prevention  and  mitigation  or  preparedness,  or  lack  of  agreement  or  consistency  in  the 
definition  of  tactics,  operations,  and  strategy,  or  frustration  over  systemic  mission-creep, 
or  any  other  common  frustration  amongst  practitioners  as  documented  in  after  action 

*  Robert  de  Neufville,  “Instrumentalism,”  Encyclopedia  Britannica,  accessed  January  1,  2016,  http:// 
www.britannica.com/topic/instrumentalism. 
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reports  from  incidents  large  and  small,  it  is  proposed  (and  indeed  the  problem  statement 
of  this  study)  that  the  idea  of  incident  management  in  its  current  manifestation  is  under¬ 
encompassing.  The  instrumental  value  of  incident  management  as  an  idea  or  sense 
making  tool  in  its  current  form  is  found  wanting. 

To  make  the  idea  of  incident  management  as  a  tool  for  sense  making  more 
instrumental,  or  useful  as  a  conceptual  model,  this  study  discovers,  analyzes,  and 
validates  the  problem.  The  study  then  provides  a  comprehensive  step-by-step  rebuild  of 
its  foundational  and  deficient  components  in  an  exploratory  manner,  an  exercise  in 
radical  empiricism  in  other  words,  resulting  in  a  proposed  conceptual  model.  The 
proposed  conceptual  model  is  then  applied  to  four  case  examples  (a  major  Stafford  Act 
event,  a  non-Stafford  Act  event,  a  domestic  terrorist  non-Stafford  Act  event,  and  an  off¬ 
shore  non-Stafford  Act  event),  which  serves  to  help  illustrate  the  applicability  of  the 
proposed  conceptual  model.  The  application  section  is  then  followed  by  conclusion  and 
implementation  sections. 

As  Clive  Barnett  states  in  his  paper  on  Foucault’s  problemitization,  “If  we  see 
problematizations  as  amplifications  or  intensifications  of  domains  of  engaged  action,  then 
the  pressing  analytical  task  is  no  longer  viewed  as  one  of  critical  disruption,  but  rather 
one  of  rearranging  what  is  already  known,  of  seeking  to  ‘make  visible  what  is  visible.’”2 
It  seems  incident  management  then,  through  the  discovery  and  analysis  section  of  this 
study,  has  been  effectively  problematized,  what  is  left  then  is  to  rearrange  what  is  already 
known  and  make  visible  what  is  visible  with  a  new  conceptual  model. 

A.  PROBLEM  STATEMENT 

Within  the  incident  management  enterprise,  various  conflicting  and  vague 
definitions,  terminologies,  roles  and  responsibilities,  and  concepts  are  found  in  policy, 
code,  doctrine,  and  mission  statements.  This  issue,  combined  with  widely  differing 
incident  management  organizational  structures,  has  created  philosophical,  operational, 
and  identity  conflicts  for  incident  managers.  These  conflicts  force  incident  managers  to 

2  Clive  Barnett,  “On  Problematization:  Elaborations  on  a  Theme  in  ‘Late  Foucault,’”  accessed  January 
1,  2016,  http://nonsite.org/article/on-problematization. 
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choose  which  competing  interpretations  or  paradigms  they  subscribe  to  before,  during, 
and  after  major  incidents  and  events.  The  lack  of  clear  understanding  on  the  part  of 
incident  management  practitioners  of  all  types  and  all  of  their  various  stakeholders  for 
what  incident  management’s  primary  principles,  definitions,  components,  and  concepts 
should  be,  particularly  where  their  respective  mission  spaces  interface,  has  created 
conflict,  confusion,  and  frustration  amongst  practitioners  and  may  be  hindering 
successful  incident  management  endeavors  (during  incidents  and  day-to-day).  This 
problem  is  corroborated  through  practitioner  interviews  in  the  discovery  and  analysis 
section  of  this  study. 

Discovering,  illuminating,  describing,  defining,  binding,  and  categorizing  the 
various  aspects  and  components  of  the  incident  management  enterprise  will  help  to 
identify  and  de-conflict  the  current  narratives  and  mission  spaces  within  the  burgeoning 
and  well-established  disciplines  that  compose  the  incident  management  enterprise  and 
promote  consistent  expectations  for  practitioners  and  organizations.  This  process  will 
help  to  discern  a  more  satisfying  and  appropriate  sense-making  model  for  understanding 
the  components  and  concepts  of  incident  management. 

Through  the  course  of  this  research,  a  validation  that  in  fact  a  pervasive  pattern  of 
vagueness,  obfuscation,  and  inconsistency  in  the  existing  incident  management  doctrine 
does  exist  is  provided  through  discovery  and  analysis,  with  specifically  categorized  and 
identified  discrepancies.  This  process  allowed  for  a  proposed  sense-making  framework 
and  conceptual  model  with  bounded  domains  of  incident  management  mission  spaces, 
activities,  components,  defined  phases  of  incident  management,  and  methods  for 
determining  the  knowledge,  skills,  and  abilities  of  incident  managers  (all  variants).  More 
importantly,  it  will  hopefully  allow  for  greater  clarity  and  context  for  further  discussion 
about  the  most  appropriate  way  forward  for  the  various  aspects  of  incident  management. 

A  sense-making  framework  and  conceptual  model  outlining  the  various  incident 
management  components,  mission  spaces,  paradigms  and  narratives,  and  their 
contributing  sources  will  hopefully  help  in  identifying  current  and  potential  points  of 
conflict  amongst  mission  priorities,  and  help  to  stem  the  tide  of  unproductive  future 
divergence  in  paradigms. 
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B.  RESEARCH  QUESTIONS 

What  are  the  current  gaps  between  reality  and  literature,  overlaps,  obfuscations, 
and  areas  lacking  clarity  in  the  various  incident  management  doctrine  definitions, 
components,  and  concepts? 

Is  a  more  satisfying  and  appropriate  sense-making  framework  and  conceptual 
model  for  understanding  the  existing  concepts  and  components  of  incident  management 
and  the  roles,  responsibilities,  and  authorities  of  incident  managers  available  to  address 
the  gaps,  overlaps,  obfuscations,  and  areas  of  lacking  clarity  in  current  doctrine? 

C.  RESEARCH  DESIGN 

The  following  sections  are  a  description  of  the  methods  and  processes  used  in 
researching  the  topic  of  incident  management.  This  description  outlines  specifically  what 
was  studied,  how  the  sources  were  identified  and  prioritized,  the  known  limits  of  the 
research  process,  which  data  sources  specifically  were  chosen,  the  specific  research  type 
or  mode  employed,  the  resulting  output,  and  a  conclusion  about  the  process  in  general. 
This  section  is  designed  to  allow  the  reader  to  understand  and  trace  the  process  of  logic 
for  this  study. 

1.  Selection 

The  extent  literature  that  makes  up  the  current  incident  management  doctrine  and 
guidance  is  the  target  of  analysis.  The  samples  of  doctrine  reviewed  demonstrate 
common  and  prevalent  pattern  phenomena.  The  problem  statement  and  justification  for 
analysis  are  validated  through  practitioner  interviews  approved  through  the  Naval 
Postgraduate  School  Human  Subject  Research  Institutional  Review  Board  (IRB).  The 
corroboration  of  the  broad  sample  of  experienced  practitioners  serves  to  solidify  and 
illustrate  the  pervasiveness  and  breadth  of  the  problem.  As  the  problem  is  assumed  to 
stem  from  a  lack  of  guidance,  definition,  and  doctrine  clarity  within  the  extent  literature, 
the  best  source  of  analysis  is  the  literature  itself.  A  new  proposed  incident  management 
conceptual  model,  serving  as  the  synthesis  of  the  interviews  and  literature  review,  are 
then  applied  to  case  example  illustrations  of  a  major  Stafford  Act  event,  a  domestic  non- 
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Stafford  Act  event,  a  domestic  terrorist  non-Stafford  Act  event,  and  an  off-shore  non- 
Stafford  Act  event.  These  event  types  were  chosen  specifically  for  their  breadth, 
relevance,  and  comprehensive  spectrum  of  application.  The  Stafford  Act  constitutes  the 
statutory  authority  for  most  federal  disaster  response  activities  especially  as  they  pertain 
to  Federal  Emergency  Management  Agency  (FEMA)  and  FEMA  programs,  and  the 
guidance  that  outlines  disaster  types  that  local  and  state  government  eligibility  for  federal 
reimbursement  for  response  activities.3 

2.  Limits 

The  specific  or  assumed  causes  of  any  identified  doctrine  deficiencies  or  trends 
are  not  evaluated  specifically.  This  study  simply  demonstrates  that  they  exist  and 
provides  recommended  methods  for  going  forward  by  proposing  new  frames  and  models 
of  perspective.  Additionally,  the  synthesis  is  a  qualitative  subjective  approach  of  radical 
empiricism  and  an  inductive  Socratic  method  of  hermeneutic  exploration.  Due  to  its 
subjective  nature,  this  method  inherently  lends  itself  to  critique,  which  is  expected  and 
invited,  as  the  intent  of  the  synthesis  is  to  encourage,  incite,  and  inspire  an  academic  and 
professional  dialogue  of  Socratic  dialectic  debate  that  will  ultimately  result  in  more 
effective,  pragmatic,  and  appropriate  incident  management  doctrine. 

3.  Data  Sources 

Practitioner  interview  data  was  gathered  to  validate  that  the  problem  identified  in 
the  problem  statement  is  common  and  pervasive.  An  inductive  and  categorical  analysis  of 
missing,  confusing,  overlapping,  or  obfuscated  elements  amongst  the  extent  literature 
was  identified  in  the  literature  review  serving  as  data  points.  Additionally,  as  validation 
for  the  utility  of  the  inductive  synthesis  (proposed  incident  management  conceptual 
model),  case  example  after  action  reports  of  a  major  Stafford  Act  event,  a  non-Stafford 
Act  event,  a  domestic  terrorist  non-Stafford  Act  event,  and  an  off-shore  non-Stafford  Act 
event  were  evaluated  through  the  lens  of  the  proposed  model’s  concepts. 


3  Federal  Emergency  Management  Agency.  Robert  T.  Stafford  Disaster  Relief  and  Emergency 
Assistance  Act,  as  amended,  and  Related  Authorities  (FEMA  592)  (Washington,  DC:  Federal  Emergency 
Management  Agency,  2007),  http://www.fema.gov/pdf/about/stafford_act.pdf. 
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4.  Type  and  Mode  of  Analysis 

Using  a  qualitative  research  paradigm  and  an  inductive  systematic  method  to 
accomplish  practitioner  interviews  and  a  literature  review  and  analysis,  this  study  finds 
and  catalogs  the  gaps  between  doctrine  and  reality,  as  well  as  persistent  patterns  of 
overlaps,  obfuscations,  and  areas  lacking  clarity  in  the  various  incident  management 
components  found  in  doctrine.  This  study  then  provides  a  new  proposed  conceptual 
model  based  on  an  empirical  inductive  Socratic  synthesis  and  evaluation  of  cogent 
aspects  of  currently  existing  perspectives  to  fill  in  the  identified  gaps  in  the  extent 
literature  and  doctrine  discovered  in  the  interviews  and  literature  review.  The  specific 
steps  are  as  follows: 

•  Complete  interviews  of  incident  management  practitioners  to  test  the 
hypothesis  that  the  problem  exists,  and  if  it  exists,  its  potential  scope. 

•  Conduct  an  in  depth  analysis  of  the  extent  literature  identified  in  the 
literature  review  specifically  to  identify  and  catalogue  patterns  of 
confusion,  conflict,  lack  of  clarity,  and  lack  of  definition. 

•  Synthesize  the  literature  analysis  and  propose  a  rectified  incident 

management  lexicon  and  components  list. 

•  Conceptually  graph  or  model  the  proposed  incident  management  lexicon 
and  components  and  provide  appropriate  explanatory  narrative. 

•  Examine  applicability  of  proposed  incident  management  lexicon, 

components,  models,  and  graphs  through  case  example  application. 

•  Provide  conclusions  and  implementation  recommendations  for  the 

proposed  incident  management  conceptual  model  for  understanding  the 
concepts  of  incident  management. 

5.  Output 

The  proposed  conceptual  model  is  a  series  of  visual  conceptual  charts 
accompanied  by  narrative  descriptions,  as  well  as  a  proposed  lexicon  of  definitions  and 
definition  justifications  making  up  a  sense-making  model  to  provide  a  better  definition  of 
the  various  components  and  concepts  of  incident  management  followed  by 
recommendations  for  implementation.  The  provided  conceptual  model  and  framework 
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will  improve  the  definition  and  hopefully  stymie  the  continued  future  persistence  of  the 
negative  patterns  and  findings  identified  in  the  literature  review  and  analysis. 
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II.  INTERVIEWING  INCIDENT  MANAGEMENT 
PRACTITIONERS 


To  prove  that  the  problem  described  in  the  problem  statement  exists,  and  its 
potential  scope  or  pervasiveness,  interviews  of  a  sample  of  experienced  incident 
management  practitioners  from  across  the  incident  management  enterprise  were 
interviewed.  Employing  the  interview  process  ensures  that  the  voices  of  those  who  are 
most  intimately  familiar  with  the  source  data  (incident  management  doctrine)  and  who 
have  experience  implementing  it  are  heard  and  integrated  in  to  the  analysis  of  the  extent 
literature.  The  experiences,  lessons  learned,  and  resulting  opinions  and  perspectives  of 
these  experienced  practitioners  are  in  turn  extremely  valuable,  and  an  absolutely  integral 
part  of  this  study  and  its  results.  The  findings  and  conceptual  model  that  is  this  study’s 
product  are  meant  to  directly  serve  and  enhance  the  capabilities  and  processes  of  the 
interviewees  and  practitioners  like  them.  The  interviews  generally  lasted  about  an  hour, 
with  a  couple  of  them  going  nearly  two  hours  long,  which  is  over  10  hours  of  answers. 
Considering  only  twelve  questions  were  asked,  it  is  a  lot  of  information.  While  it  is  not 
feasible  to  completely  distill  all  of  the  tremendous  and  interesting  insights  provided  by 
the  interviewees,  and  a  number  of  very  interesting  comments  and  trends  were  discovered 
during  the  interviews  that  would  likely  be  of  interest  to  the  incident  management 
enthusiast,  many  were  very  subjective  in  nature  and  were  not  suitable  as  distilled 
findings.  The  value  of  some  of  these  more  subjective  trends  of  interest  are  intended  to  be 
captured  within  this  study’s  proposed  conceptual  model. 

A.  SELECTING  THE  PRACTITIONERS 

To  obtain  a  diverse  sample  of  the  incident  management  enterprise,  practitioners 
were  selected  from  federal,  state,  county,  and  municipal  agencies  from  disciplines  (or 
with  experience  in  disciplines),  such  as  emergency  management,  firefighting,  law 
enforcement,  public  health,  emergency  medical  services,  and  several  branches  of  the 
military.  The  practitioners  were  each  selected  by  the  author  of  this  study  because  they 
were  known  to  the  author  as  personal  connections  with  extensive  or  significant 

experience,  credentials,  qualifications,  education,  position,  or  a  combination  thereof.  The 

9 


seven  interviewees  have  a  collective  150  years  of  experience  within  the  incident 
management  enterprise.  While  the  focus  of  this  thesis  is  public  sector  incident 
management  structures  and  concepts,  which  may  be  analogous  to  private  sector 
implementation,  it  should  be  noted  that  private  sector  incident  management  practitioners 
were  not  part  of  the  interview  sample. 

The  majority  of  the  practitioners  selected  currently  hold  positions  in  California, 
partially  due  to  convenience  for  the  interviewer;  however,  this  dynamic  presents 
advantages  and  disadvantages.  California  has  one  of  the  most  robust,  renowned,  and 
established  statewide  emergency  management  systems,  and  such,  perhaps  provides  a 
greater  granularity  in  the  context  of  experience  the  interviewed  practitioners  have. 
Additionally,  California  is  subject  to  some  of  the  most  frequent  large  natural  disasters  and 
incidents  in  the  country,  which  allows  practitioners  across  the  state  to  apply  their 
knowledge  and  discipline  in  real  world  events  relatively  often.  The  downside  to  this 
selection  is  that  every  state  is  not  California,  and  may  not  be  able  to  or  interested  in 
implementing  a  similar  system  to  California,  and  the  experiences  and  analogies  the 
interviewees  provide  may  not  be  completely  analogous  to  other  states.  Fortunately,  this 
study  does  not  necessarily  seek  to  promote  California’s  statewide  emergency 
management  system,  and  many  of  the  practitioners  have  experience  in  positions  outside 
of  the  state  of  California  that  helps  to  broaden  the  value  of  their  perspective. 

The  following  events  are  a  small  example  or  sample  of  the  type  of  events  the 
interviewees  have  participated  in:  September  11,  2001,  Hurricane  Katrina,  Hurricane 
Sandy,  Deep  Water  Horizon,  Northridge  earthquake,  Napa  County  earthquake,  the  Lake 
County  wildfires,  the  Tea,  Zaca,  and  Jesusita  fires  in  Santa  Barbara  County,  and  Y2K 
preparations.  This  list  is  not  meant  to  inspire  an  “appeal  to  authority”  logic  fallacy,  but 
merely  to  demonstrate  that  the  practitioner  perspectives  are  relevant  to  current  incident 
management  doctrine.  To  avoid  the  “appeal  to  authority”4  logic  fallacy,  the  names  and 


4  (Just  because  an  authority  says  something  does  not  make  it  inherently  true.)  Jesse  Richardson,  Andy 
Smith,  and  SamMeaden,  “Your  Logical  Fallacy  Is...,”  Flip  Creative,  accessed  July  25,  2016,  https://your 
logicalfallacyis.com/appeal-to-authority. 
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positions  of  the  interviewees  have  been  specifically  omitted  from  the  published  version  of 
this  study. 

B.  TYPES  OF  QUESTIONS 

The  questions,  which  are  listed  in  Appendix  A,  were  designed  to  elicit  insight  and 
experiences  related  to  incident  management  doctrine  and  guidance  documents.  The  first 
questions  were  designed  to  encourage  the  interviewees  to  reflect  on  their  experience  and 
the  events  they  have  responded  to  or  participated  in,  and  they  are  then  considered  primed 
for  analysis.  The  following  several  questions  were  designed  to  elicit  critical  analysis  of 
the  interviewees’  experience  participating  in  the  response  aspects  of  incident 
management,  and  how  doctrine  or  guidance  documents  aided  or  hindered  their 
experience.  The  next  questions  were  designed  to  elicit  critical  analysis  of  the 
interviewees’  broader  experience  applying  incident  management  doctrine  and  guidance 
documents  during  the  entire  incident  management  process  individually,  organizationally, 
in  an  inter-agency  capacity,  or  as  an  individual  agency.  The  final  questions  were  designed 
to  elicit  thoughtful  reflection  on  pivotal  elements  of  success. 

Ultimately,  the  interview  was  designed  to  allow  a  healthy  sample  of  incident 
management  enterprise  practitioners  with  significant  experience  to  explore  critically  their 
frustrations,  successes,  and  general  perspectives  of  existing  incident  management 
doctrine  and  guidance  with  the  outcome  of  identifying  areas  of  consistency, 
corroboration,  or  correlation.  The  questions  were  designed  specifically  not  to  incite  any 
specific  bias  or  elicit  answers  that  could  be  used  in  a  “gotcha”  style  critique  of  the 
practitioners  themselves.  The  interviewees  were  encouraged  to  answer  the  questions  with 
as  much  brevity  or  elaboration  as  necessary  that  they  were  comfortable  in  answering. 

C.  INTERVIEW  RESULTS 

The  outcome  of  these  interviews  is  a  list  of  insightful  findings  and 
recommendations,  as  well  as  a  consistent  trend  of  corroboration.  Although,  a  few 
interesting  areas  of  divergence  arose  amongst  the  interviewee’s  answers.  The  following 
sections  discuss  the  answers  and  responses,  disagreements  and  inconsistencies,  intriguing 

comments  and  trends,  as  well  as  a  distillation  of  the  results. 
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1. 


Useful  Sources  of  Doctrine 


When  asked  which  incident  management  publications,  guidance,  or  pieces  of 
doctrine  were  most  useful  to  them  throughout  their  careers,  the  following  were 
mentioned:  ICS  Field  Operating  Guide,  The  National  Response  Framework,  the  2011 
NIMS  Training  Documents,  The  California  Standardized  Emergency  Management 
System  Function/Section  Specific  Guidance,  Coast  Guard  Publication  3-28:  Incident 
Management  and  Crisis  Response,5  The  FEMA  Action  Planning  Guide,  National  Fire 
Protection  Association  (NFPA)  1600:  Standard  on  Disaster/Emergency  Management  and 
Business  Continuity/Continuity  of  Operations  Programs,  and  NIMS.  Several  interviewees 
responded  that  there  was  no  one  document  that  has  been  particularly  helpful. 

2.  Distilling  the  Results 

Not  only  did  these  interviews  validate  and  corroborate  the  problem  statement  for 
this  study,  and  the  purpose  for  conducting  them  in  fact,  but  they  also  illuminated  a 
number  of  additional  interesting  findings  related  to  gaps  and  deficiencies  within  incident 
management  doctrine  and  the  enterprise’s  conceptual  understanding  of  itself.  It  should  be 
noted  that  due  to  the  limited  number  of  interviewees,  the  following  findings  are  purely 
preliminary  and  interesting  as  potential  points  for  further  investigation.  The  following  list 
of  findings  is  derived  from  the  interviews  in  their  entirety  (many  of  these  findings  are  not 
outlined  specifically  in  the  aforementioned  overview  for  brevity  purposes): 

•  Practitioners  consistently  agree  that  discipline  and  cultural  differences  are 
pervasive  because  of  a  lack  of  common  foundational  incident  management 
training  amongst  all  practitioners  within  the  enterprise. 

•  Many  practitioners  felt  that  a  difference  existed  between  appropriate  and 
inappropriate  mission  creep.  For  example,  filling  the  role  of  a  city  without 
being  asked  or  expressed  permission  by  a  county  when  the  city  has  no 
capability  to  execute  its  roles  and  responsibilities  for  public  safety  is  an 
example  of  potentially  appropriate  mission  creep.  Whereas,  an  EOC 
redundantly,  inadvertently,  or  purposely  directing  tactical  operations  in  the 
field  or  at  the  incident  is  an  example  of  inappropriate  mission  creep. 


5  U.S.  Coast  Guard,  Incident  Management  and  Crisis  Response  (Publication  3-28)  (Washington,  DC: 
U.S.  Coast  Guard  Headquarters,  2014),  https://www.uscg.mil/doctrine/CGPub/CG_Pub_3-28.pdf. 
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•  All  the  interviewees  expressed  in  some  way  that  incident  management 
champions  and  authorities  with  legitimacy  need  to  be  identified  and  given 
a  voice  and  medium  for  frequent  national  dialogue  and  mentorship. 

•  Many  practitioners  feel  that  a  systemic  practice  of  accountability  for 
incident  management  organizations  and  agencies  needs  to  be  more 
nationally  consistent  to  ensure  best  practices  are  being  identified,  poor 
practices  are  being  identified  and  reduced,  and  capabilities  and  operational 
capacity  is  being  increased  nationwide. 

•  Many  incident  management  practitioners  do  not  consider  themselves  part 
of  a  larger  collective  “enterprise,”  or  are  unaware  that  they  are. 

•  Amongst  some  practitioners  is  a  perception  that  FEMA  is  not  a  suitable 
incident  management  lead.  It  only  has  legitimacy  in  the  consequence 
management  aspects  of  incident  management,  and  no  legitimacy  in  the 
crisis  management  and  threat  management  (pre-incident)  side  of  things. 

•  Practitioners  agree  that  mission  spaces  have  not  been  bound  well  in 
current  doctrine.  Practitioners  do  not  feel  that  FEMA  has  an  interest  in 
bounding  mission  space,  nor  professional  organizations  (such  as 
International  Association  of  Emergency  Managers  (IAEM)).  A  better 
venue  for  national  dialogue  is  needed  to  determine  best  bounding  of 
mission  spaces. 

•  While  some  interviewees  feel  that  the  definition  of  various  incident 
management  disciplines,  actions,  event  types,  activity  levels,  etc.,  and  the 
differences  between  them  need  to  be  more  clearly  delineated  in 
foundational  documents,  others  feel  that  the  problem  lies  in  the 
implementation  of  current  doctrine.  In  either  case,  it  seems  the  problem 
lies  with  the  doctrine,  in  that  it  is  not  clear  or  prescriptive  enough  to  be 
implemented  consistently. 
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III.  LITERATURE  REVIEW 


“Crisis”  is  a  lay  term  in  search  of  a  scholarly  meaning.6 

~  James  A.  Robinson 

Since  the  end  of  World  War  n,  Congress  and  Presidents  have  debated, 
formulated,  and  revised  administrative  responsibilities  for  emergency 
management.7 


~  Henry  B.  Hogue  and  Keith  Bea 


A.  DISCERNING  EMERGENCY  AND  INCIDENT  MANAGERS 

Based  on  this  study’s  practitioner  interviews,  it  is  apparent  that  disagreement, 
confusion,  and  a  lack  of  clarity  occur  about  whether  incident  management  and  emergency 
management  are  synonymous  concepts.  Some  of  the  practitioners  used  the  terms 
interchangeably,  while  others  considered  incident  management  to  be  under  the  umbrella 
of  emergency  management,  and  others  felt  that  emergency  management  was  merely  one 
component  of  incident  management.  Based  on  this  phenomenon,  it  seems  that  the  best 
course  of  action  in  determining  what  the  conceptual  model  for  managing  incidents  and 
events  should  be  is  to  discern  between  these  two  terms  in  the  existing  literature.  The 
exploration  of  the  leading  doctrine  and  literature  on  this  topic  will  then  likely  reveal  the 
sources  of  other  relevant  components  and  areas  of  needed  definition  or  exploration. 

The  research  available  on  the  topic  of  emergency  and  incident  management 
narratives  and  paradigms  specifically  is  extremely  limited.  However,  the  available 
research,  literature,  and  data  available  on  emergency  management  as  a  profession  and  its 
evolving  mission  space  in  general  are  extremely  broad.  This  review  is  therefore  a 
comparative  analysis  of  the  various  sources  that  define  explicitly  and  implicitly  the  roles, 
responsibilities,  and  expectations  of  emergency  management,  and  how  they  inform 

6  James  A.  Robinson,  “Crisis,”  International  Encyclopedia  of  the  Social  Sciences  3  (1968):  510-514. 

7  Henry  B.  Hogue  and  Keith  Bea,  Federal  Emergency  Management  and  Homeland  Security 
Organization:  Historical  Developments  and  Legislative  Options  (RL33369)  (Washington,  DC: 
Congressional  Research  Service,  2006),  4. 
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various  narratives  and  paradigms  within  incident  management  that  may  be  congruent  or 
incongruent.  This  analysis  will  hopefully  help  to  define  new  emergency  and  incident 
management  paradigms  and  narratives  and  inform  a  model  for  categorizing  elements  of 
those  newly  defined  narratives  and  paradigms. 

This  literature  review  is  separated  into  seven  categories  that  address  sources  of 
explicit  and  implicit  expectations  of  emergency  management  within  incident 
management,  where  specific  laws,  funding  requirements,  policies,  plans,  and  procedures 
exist,  where  they  are  consistent  or  inconsistent,  and  which  types  of  emergency 
management  and  incident  management  narratives  they  inform.  The  various  sources  of 
explicit  and  implicit  roles,  responsibilities,  and  expectations  of  emergency  and  incident 
management  lend  themselves  to  being  interpreted  and  applied  differently  and  selectively 
amongst  practitioners,  thus  creating  various  paradigms  and  narratives  that  then  inform 
mission  priorities  that  may  be  in  conflict  with  the  mission  priorities  of  other  organizations 
with  a  different  paradigm. 

B.  EXPECTATIONS,  ROLES,  AND  RESPONSIBILITIES  OF  EMERGENCY 

AND  INCIDENT  MANAGEMENT 

The  definition  of  explicit  according  to  Merriam-Webster  is:  “Fully  revealed  or 
expressed  without  vagueness,  implication,  or  ambiguity  and  leaving  no  question  as  to 
meaning  or  intent.”8  An  explicit  expectation  in  regards  to  emergency  management  for  the 
purpose  of  this  analysis  is  one  that  outlines  specific  requirements,  actions,  or  roles  and 
responsibilities.  Thousands  of  explicit  and  implicit  expectations  are  likely  placed  on 
emergency  and  incident  management,  for  ease  of  classification  and  evaluation,  a 
categorization  of  the  sources  of  those  expectations  should  be  established.  For 
simplification  purposes,  the  most  obvious  categories  of  expectations  are  used: 

•  federal  government  level  plans,  policies,  and  regulations 

•  state  government  level  plans,  policies,  and  regulations 

•  local  government  level  plans,  policies,  and  regulations 

8  Merriam-Webster  OnLine,  s.v.  “Explicit,”  accessed  April  17,  2015,  http://www.merriam- 
webster.com/dictionary/explicit. 
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•  emergency  management  grant  guidance 

•  professional  association  guidance 

•  accreditation  and  training  institution  guidance 

•  academic  and  practitioner  documents 

In  the  following  subsections,  each  of  the  aforementioned  source  categories  of 
emergency  and  incident  management  expectations  are  explored. 

1.  Federal  Government  Level  Plans,  Policies,  and  Regulations 

The  following  literature  is  the  most  relevant  list  of  federal  level  documents  that 
establish  explicit  and  implicit  emergency  management  and  incident  management 
expectations:  the  National  Preparedness  Goal,9  the  National  Response  Framework ,10 
National  Infrastructure  Protection  Plan,11  Emergency  Services  Sector-Specific  Plan:  An 
Annex  to  the  National  Infrastructure  Protection  Plan,12  The  National  Incident 
Management  System ,13  The  Emergency  Management  Assistance  Compact ,14  The 
Homeland  Security  Act  of  2002, 15  and  the  Post-Katrina  Emergency  Management  Reform 
Act  of  2006. 16  These  documents  are  the  guiding  federal  documents  for  emergency 


9  Jeh  Johnson,  National  Preparedness  Goal,  2nd  ed.  (Washington,  DC:  Department  of  Homeland 
Security  (DHS),  2015),  http://www.fema.gov/media-library-data/1443799615171-2aae90be55041740f97 
e8532fc680d40/National_Preparedness_Goal_2nd_Edition.pdf. 

I®  Federal  Emergency  Management  Agency,  National  Response  Framework,  2nd  ed.  (  Washington, 
DC:  U.S.  Department  of  Homeland  Security,  2013),  3,  http://www.fema.gov/media-library-data/20130726- 
19 14-25045-  1246/final_national_response_ffamework_201 30501.  pdf. 

11  Michael  Chertoff,  National  Infrastructure  Protection  Plan  (Washington,  DC:  Department  of 
Homeland  Security  (DHS),  2009),  http://emilms.fema.gov/IS821/assets/NIPP_Plan.pdf. 

1-  Todd  M.  Keil,  Emergency  Sendees  Sector-Specific  Plan:  An  Annex  to  the  National  Infrastructure 
Protection  Plan  (Washington,  DC:  Department  of  Homeland  Security  (DHS),  2010),  http://www.dhs.gov/ 
xlibrary/assets/nipp-ssp-emergency-services.pdf. 

13  Federal  Emergency  Management  Agency,  National  Incident  Management  System  (Washington,  DC: 
U.S.  Department  of  Homeland  Security,  2008),  http://www.fema.gov/pdf/emergency/nims/NIMS_core.pdf. 

14  Emergency  Management  Assistance  Compact,  Pub.  L.  No.  104-321,  art.  II  (1996)  http://www.emac 
web.org/index.php/learnaboutemac/emac-legislation. 

13  Homeland  Security  Act  of  2002,  Pub.  L.  No.  107-296  (2002),  http://www.dhs.gov/xlibrary/assets/ 
hr_5005_enr.pdf. 

I6  Susan  M.  Collins,  “S.3721 — Post-Katrina  Emergency  Management  Reform  Act  of  2006,  109th 
Congress  (2005-2006),”  Congress.gov,  July  25,  2006,  https://www.congress.gov/bill/109th-congress/ 
senate-bill/3721. 
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management  that  specifically  address  emergency  management  as  a  capability,  discipline, 
organizational  structure,  or  activity. 

The  casual  reader  and  emergency  management  practitioner  might  think  the 
aforementioned  list  is  missing  key  documents,  such  as  the  Stafford  Act,  Homeland 
Security  Presidential  Directive  five  (HSPD-5),  and  various  presidential  policy  directives, 
such  as  PPD-1.  However,  none  of  those  documents  specifically  address  emergency 
management  as  a  discipline  or  function,  nor  do  they  address  emergency  managers,  crisis 
managers,  risk  managers,  or  incident  managers  as  practitioners  having  any  specific  role. 

Ultimately,  at  the  federal  level,  the  explicit  expectations,  roles,  responsibilities, 
authorities,  and  definitions  of  various  incident  management  (using  the  term  broadly) 
practitioners  and  their  various  professions  are  nuanced,  sometimes  convoluted, 
occasionally  in  conflict,  and  often  add  or  build  upon  each  other.  The  terms  emergency 
management,  crisis  management,  incident  management,  business  continuity,  and 
emergency  and  disaster  preparedness  seem  to  be  used  fairly  interchangeably,  and  distinct 
delineation  amongst  these  terms  is  very  illusive.  Greater  definition  of  these  various  terms 
and  practices  would  be  extremely  beneficial  in  federal  documents  to  help  guide 
appropriate  response,  coordination,  and  professional  distinction.  Emergency  management 
seems  to  have  become  the  catch-all  term  for  each  of  these  very  different  aspects. 

2.  State  Government  Level  Plans,  Policies,  and  Regulations 

Analyzing  and  synthesizing  the  various  explicit  definitions  and  delineations  of 
emergency  management  terms  and  concepts  from  each  of  the  50  American  states,  while 
potentially  useful,  is  extremely  arduous  and  probably  not  entirely  necessary.  Most,  if  not 
all  states,  have  a  state  emergency  management  organization  of  some  sort  and  have  an 
emergency  operations  plan  of  some  sort.  Within  those  plans  are  descriptions  of  state 
emergency  management  personnel  and  local  emergency  managers,  as  well  as  the  function 
of  EOCs  and  their  relationship  with  the  field.  The  similarities  and  homogeneity  amongst 
plans  at  the  state  level  in  regards  to  terms  and  definitions  is  likely  due  in  part  to  the 
inherent  vagueness  and  scope  of  state  level  plans,  as  well  as  the  fact  that  they  primarily 
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use  the  same  guiding  federal  documents  and  language  as  a  framework.  However,  some 
small  differences  should  be  noted. 

To  synthesize  some  of  the  primary  key  differences  amongst  states  quickly, 
language  specific  to  four  very  different  state  emergency  operations  plans  are  highlighted: 
Alabama,  California,  Colorado,  and  New  York.  These  four  states  were  chosen  due  to  the 
fact  that  their  plans  were  easily  accessible,  were  in  very  different  regional  geographic 
areas,  had  widely  varied  plans  in  scope  and  character,  and  were  states  with  very  different 
hazard  and  threat  profiles. 

Evaluating  these  four  EOPs  provides  great  comparison  and  contrast  and  an 
example  of  how  different  and  nuanced  the  terms  are  from  one  state  to  the  next.  One 
foundational  aspect  about  the  comparison  of  these  documents  is  in  the  authority  for 
command  and  control  that  they  respectively  give  to  the  EOCs.  Additionally,  the 
continued  lack  of  definition  for  emergency  management  and  emergency  managers  is 
particularly  interesting.  Only  vague  references  to  emergency  managers  appeared 
specifically  in  any  of  these  documents,  and  no  reference  at  all  in  some. 

3.  Local  Government  Level  Plans,  Policies,  and  Regulations 

The  proverbial  rubber  meets  the  road  in  local  government  emergency 
management.  Many  federal  documents  highlight  the  fact  that  emergency  management 
happens  at  the  local  level.  Interestingly,  the  local  level  is  where  the  majority  of 
discrepancies  between  documents  and  plans  happen  and  where  lack  of  continuity  and 
inconsistency  amongst  emergency  management  paradigms  seems  to  have  the  most 
prevalence.  Even  amongst  neighboring  jurisdictions,  the  major  policy,  doctrine,  and  plan 
discrepancies  might  hinder  effective  integration  and  cooperation  during  regional  events, 
and  skew  the  expectations  of  emergency  management  stakeholders  amongst  the 
jurisdictions.  As  an  example,  three  California  Bay  Area  neighboring  jurisdictions’ 
emergency  operations  plans  were  evaluated:  San  Mateo  County,  San  Francisco 
City/County,  and  Santa  Clara  County. 

One  key  item  to  point  out  about  all  these  local  emergency  operations  plans  is  that 
they  often  describe  what  emergency  management  is,  but  not  what  emergency  managers 
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are.  While  examining  how  emergency  managers  are  defined  in  state  legislature  is  not 
within  the  scope  of  this  study’s  research,  this  issue  remains  an  interesting  observation. 
Furthermore,  the  disparity  between  the  identified  phases  of  emergency  management  and 
the  roles  and  responsibilities  that  fall  under  the  associated  phases  for  emergency 
management  is  a  major  issue,  especially  in  terms  of  a  coordinated  response.  It  also 
creates  some  significant  differences  in  expectations  of  services  provided  and  performance 
metrics  from  key  stakeholders  and  organizational  leadership.  If  one  emergency 
management  office  is  tasked  with  prevention  and  protection  responsibilities  and  another 
is  not,  then  that  difference  could  potentially  create  some  significant  operational  confusion 
and  incompatibilities.  When  this  issue  persists  in  neighboring  jurisdictions,  as  it  does  in 
these  three,  it  can  create  major  and  obvious  paradigm  differences  amongst  emergency 
management  practitioners  as  well. 

4.  Emergency  Management  Federal  Grant  Guidance 

When  trying  to  get  to  the  bottom  of  a  difficult  problem  or  issue,  it  is  often 
recommended  that  people  “follow  the  money.”  In  emergency  management,  the  money 
comes  from  a  federal  grant  passed  through  the  states  down  to  the  local  level.  This  grant  is 
called  the  emergency  management  performance  grant  (EMPG). 

Given  that  “emergency  management  performance”  is  in  the  name  of  the  grant,  if 
the  money  (grant  dollars)  is  followed  to  look  for  a  definition  of  emergency  management 
or  to  discern  what  it  is  emergency  managers  do,  it  might  appear  that  they  do  everything. 
It  seems  that  effective  emergency  management  performance  is  synonymous  with 
everything  that  falls  under  the  national  preparedness  goal,  inclusive  of  all  its  missions  and 
capabilities.  In  addition,  the  fact  that  response  equipment,  cyber  security  equipment,  and 
other  detection  equipment  combined  with  the  various  national  preparedness  missions  and 
capabilities  may  lead  to  the  belief  that  emergency  management  includes  the  full  spectrum 
of  emergency  response,  support,  coordination,  command,  and  control.  In  this  situation, 
following  the  money  might  not  be  the  best  method  for  discernment  or  inquiry. 
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5. 


Professional  Associations 


The  NFPA  has  created  a  document  outlining  standards  for  emergency 
management  and  business  continuity  programs  titled  “NFPA  1600:  Standard  on 
Disaster/Emergency  Management  and  Business  Continuity  Programs,”  which  defines 
disaster  and  emergency  management  synonymously  as  “the  ongoing  process  to  prevent, 
mitigate,  prepare  for,  respond  to,  maintain  continuity  during,  and  to  recover  from,  an 
incident  that  threatens  life,  property,  operations,  or  the  environment.”17  Interestingly,  this 
document  includes  prevention  but  not  protection  in  the  definition.  Meanwhile,  the  NFPA 
1600  definition  for  incident  management  and  incident  management  systems  is  more 
broad  and  overarching  stating,  “The  combination  of  facilities,  equipment,  personnel, 
procedures,  and  communications  operating  within  a  common  organizational  structure  and 
designed  to  aid  in  the  management  of  resources  during  incidents.”18  Additionally,  under 
the  response  section  of  NFPA  1600,  a  great  effort  is  made  to  allow  flexibility  in  the  title 
of  emergency  management  practitioners.  It  recognizes  that  the  program  coordinator  for 
the  emergency  management  program  may  hold  the  title  emergency  manager  (in  the 
public  sector),  business  continuity  manager  (in  the  private  sector),  or  emergency 
management  program  coordinator  as  examples.19  It  is  stated,  “the  program  coordinator 
shall  be  appointed  by  the  entity’s  leadership  and  authorized  to  develop,  implement, 
administer,  evaluate,  and  maintain  the  program.”20  The  list  of  assessment  tool 
recommendations  includes  issues  like  budgets,  records  management,  planning,  risk 
assessments,  impact  analysis,  resource  needs  analysis,  performance  objectives,  plans 
specifically  addressing  prevention,  mitigation,  crisis  communication  and  public 
information,  warning  notifications  and  communication,  operations  procedures,  EOC 


17  National  Fire  Protection  Association,  NFPA  1600:  Standard  on  Disaster/Emergency  Management 
and  Business  Continuity  Programs  (Quincy,  MA:  National  Fire  Protection  Association,  2013),  5,  http:// 
www.nfpa.org/assets/fiies/AboutTheCodes/1600/1600-13-PDF.pdf. 

18  Ibid.,  6. 

19  Ibid.,  13. 


20  Ibid.,  25. 
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procedures,  an  incident  management  system,  and  emergency  operations/response  plan,  a 
training  program,  an  exercise  program,  and  program  maintenance  measures.21 

IAEM  is  probably  the  most  recognized  professional  organization  of  emergency 
management  practitioners  with  over  9,000  worldwide  members.  IAEM  is  “dedicated  to 
promoting  the  ‘Principles  of  Emergency  Management’  and  representing  professionals 
whose  goals  are  saving  lives  and  protecting  property  and  the  environment  during 
emergencies  and  disasters.”22  Their  mission  is  to  “serve  its  members  by  providing 
information,  networking  and  professional  opportunities,  and  to  advance  the  emergency 
management  profession.”23  Additionally,  IAEM  certifies  emergency  management 
practitioners  through  a  process  requiring  a  college  education  (not  necessarily  in  the 
discipline  of  emergency  management),  a  written  test  on  basic  emergency  management 
conceptual  familiarization,  and  proof  of  experience  and  career  field  contributions.  IAEM 
created  the  certified  emergency  manager  program  to  “raise  and  maintain  professional 
standards  for  emergency  managers.”24  In  the  late  1980s,  FEMA  awarded  IAEM  funds  to 
produce  a  report  on  how  to  accomplish  this  test.  A  council  of  “subject  matter  experts” 
called  the  “professional  standards  advisory  council”  was  established  representing  various 
disciplines  and  functions  related  to  or  considered  “aspects”  of  emergency  management 
(see  Figure  1).  The  definition  of  professional  benchmarks  (accomplishments, 
certifications,  trainings,  experience,  etc.)  was  deemed  the  most  appropriate  way  to  create 
professional  standards,  and  then  a  certification  program  that  documents  their 
qualifications  and  their  attainment  of  those  benchmarks. 


21  National  Fire  Protection  Association,  NFPA  1600:  Standard  on  Disaster/Emergency  Management 
and  Business  Continuity  Programs,  25-38. 

22  “Global,”  accessed  October  15,  2015,  http://www.iaem.com/. 

23  Ibid. 

24  Ibid. 
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Advisory  Council 

American  Public  Works  Association 
American  Society  for  Public 
Administration 

American  Society  of  Professional 
Emergency  Planners 
Emergency  Management  Institute 
Federal  Emergency  Management  Agency 
International  Association  of  Chiefs  of 
Police 

International  Association  of  Fire  Chiefs 
International  City  Management 
Association 

National  Association  of  Counties 
National  Coordinating  Council  on 
Emergency 

Management  (now  IAEM) 

National  Emergency  Management 
Association 

National  Emergency  Training  Center 
National  Fire  Protection  Agency 
National  Governors  Association 
National  League  of  Cities 
National  Lieutenant  Governors 
Association 

The  American  Civil  Defense  Association 
Thomas  Edison  State  College 
United  States  Conference  of  Mayors 
University  of  North  Texas 


Figure  1.  1989-93  NCCEM  Professional  Standards.25 


For  four  years  in  the  early  1990s,  IAEM  gathered  insight  from  professionals  with 
all-hazards  experience,  from  jurisdictions  of  every  type  and  size,  and  from  various  sister 
disciplines.  This  discernment  resulted  in  an  analytical  study  of  emergency  management 
as  a  profession.  The  analytical  study  led  to  a  list  of  knowledge,  skills,  and  abilities 
(KSAs)  that  the  council  deemed  needed  to  accomplish  consistent  job  duties  and  vital 

25  Source:  “History  of  the  AEM  and  CEM,  Associate  Emergency  Manager  and  Certified  Emergency 
Manager  Program,”  accessed  October  14,  2015,  http://www. iaem.com/page. cfm?p=certification/history-of- 
cem. 
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tasks  of  emergency  managers.  IAEM’s  Professional  Standards  Advisory  Council  based 
the  certification  requirements  on  these  KSAs.26 

An  important  aspect  of  the  IAEM  certification  is  that  they  are  certifying  members 
as  part  of  the  professional  body  of  emergency  management,  and  not  the  discipline  of 
emergency  management.  As  mentioned  previously,  the  members  tasked  with  creating  the 
certification  came  from  several  various  disciplines  relating  to  emergency  management. 
Additionally,  IAEM  promotes  the  “principles  of  emergency  management”  as  established 
through  Emergency  Management  Institute  (EMI)  (discussed  in  more  depth  in  the  next 
section).  These  principles  clearly  state  that  they  apply  not  to  the  discipline  or  individual 
attributes  of  an  emergency  manager,  but  to  the  profession  of  emergency  management,  a 
vital  distinction.27  Thus,  the  IAEM  emergency  management  certification  is  inherently 
broad  in  scope  and  encompasses  KSAs  across  a  wide  ranging  field  of  practitioners  who 
would  not,  through  this  certification  process,  become  uniform  in  performance  or 
individual  practitioner  capacity.  Perhaps  most  interestingly,  nowhere  in  the  IAEM 
literature  or  certification  process  is  a  definition  of  what  emergency  managers  are  or  what 
they  do  specifically;  principles  for  the  profession  and  prescribed  requirements  for  being 
certified  as  an  emergency  management  professional  are  defined,  but  what  an  emergency 
manager  is  or  does ,  and  certainly  not  how  they  do  it,  are  not. 

The  National  Emergency  Management  Association  (NEMA)  is  a  professional 
association  made  up  of  state  emergency  management  directors  and  leadership.  NEMA’s 
focus  is  on  national  leadership,  policy,  and  engagement  regarding  comprehensive 
emergency  management.  NEMA  serves  as  an  information  and  assistance  resource  for 
emergency  management  agencies  and  practitioners.  Additionally,  NEMA  seeks  to 
improve  and  create  “strategic  partnerships,  innovative  programs,  and  collaborative  policy 
positions.”28 

“History  of  the  AEM  and  CEM,  Associate  Emergency  Manager  and  Certified  Emergency  Manager 
Program.” 

27  “Emergency  Management  Principles,”  2007,  1,  http://training.fema.gov/EMIWeb/edu/emprinciples. 

asp. 

28  “What  is  NEMA?,”  accessed  October  15,  2015,  https://www.nemaweb.org/index.php/about/what-is- 
nema. 
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In  the  strategic  plan,  NEMA  states  that  its  purpose  is,  “To  develop  the 
partnerships  and  initiatives  necessary  to  improve  the  nation’s  capabilities  to  protect  the 
public  through  prevention,  mitigation,  preparedness,  response,  and  recovery  from  all 
emergencies,  disasters,  and  threats  to  our  homeland.”29  It  is  an  interesting  reference  to 
five  phases  of  emergency  management  in  which  mitigation  and  prevention  are  divided 
into  two  phases.  Interestingly,  other  places  on  their  website  reference  only  three  or  four 
phases,  demonstrating  a  lack  of  consistency.30  Once  again,  nowhere  on  NEMA’s 
webpage  or  in  their  strategic  plan  do  they  define  what  emergency  managers  are  or  what 
they  do. 

Ultimately,  these  various  professional  organizations  leave  wanting  the  discerning 
mind  searching  to  divine  what  emergency  managers  do  specifically,  or  what  the 
discipline  of  emergency  management  entails  as  opposed  to  the  larger  profession,  or  the 
difference  between  emergency  management,  crisis  management,  incident  management, 
business  continuity,  or  community  preparedness.  To  paint  the  picture  a  little  clearer,  an 
analogy  can  be  drawn  to  carpentry  and  building  houses.  NFPA  states  what  components 
are  in  a  finished  house.  IAEM  certifies  someone  as  competent  to  work  on  a  construction 
site,  while  NEMA  promotes  house  building  and  discusses  houses  at  length.  However, 
none  of  these  organizations  seem  to  be  discerning  between  electricians,  plumbers, 
roofers,  contractors,  construction  managers,  framing  carpenters,  and  finish  carpenters. 

6.  Accreditation  and  Training  Institutions 

In  2007,  FEMA’s  Emergency  Management  Higher  Education  Project,  under 
guidance  of  FEMA’s  Emergency  Management  Institute  (EMI),  established  a  panel  of 
practitioners  and  academics  to  develop  basic  foundational  principles  of  emergency 
management.  This  project  was  endeavored  upon  because  while  numerous  books,  articles, 
and  papers  referred  to  “principles  of  emergency  management,”  nowhere  in  any  of  the 
literature  on  the  subject  was  a  consensus  reached  on  a  definition  of  what  these  principles 


29  “What  is  NEMA?.” 

30  Ibid. 
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were  specifically.31  The  panel  came  up  with  eight  “principles  of  emergency 
management”  to  be  used  as  a  guide  for  the  development  of  a  doctrine  of  emergency 
management.  These  principles  have  been  adopted  by  the  major  emergency  management 
professional  organizations,  FEMA,  and  the  EMI,  as  well  as  a  number  of  other 
organizations.32 

Neither  EMI,  which  applies  the  principles  of  emergency  management,  nor  EMAP 
(emergency  management  accreditation  program),  which  accredits  emergency 
management  programs,  seem  to  have  a  clear  definition  of  what  emergency  managers  do 
specifically.  They  make  reference  to  the  profession  of  emergency  management,  and  the 
necessary  components  of  a  successful  emergency  management  program,  which  are 
composed  of  efforts,  capabilities,  and  programs  across  a  wide  array  of  disciplines, 
departments,  and  organizations.  A  lack  of  definition  about  the  scope  of  authority,  the 
specific  actions,  or  the  roles  and  responsibilities  of  the  emergency  manager  still  seems 
lacking. 

7.  Academic  and  Practitioner  Documents 

Hogue  and  Bea  perhaps  said  it  best  when  they  said,  “Since  the  end  of  World  War 
II,  Congress  and  Presidents  have  debated,  formulated,  and  revised  administrative 
responsibilities  for  emergency  management.”33  Several  scholarly  journals,  academic 
papers,  and  practitioner  articles  discuss  emergency  management,  crisis  management, 
consequence  management,  incident  management,  business  continuity,  and  community 
preparedness  broadly  and  conceptually.  For  example,  in  2007  (updated  in  2008),  Dr. 
Wayne  Blanchard  developed  the  1,366  page  “Guide  to  Emergency  Management  and 
Related  Terms,  Definitions,  Concepts,  Acronyms,  Organizations,  Programs,  Guidance, 
Executive  Orders  &  Legislation,”  which  provides  25  emergency  management  definitions, 
15  incident  management  definitions,  23  crisis  definitions,  and  20  crisis  management 


3 1  “Emergency  Management  Principles,”  1 . 

32  Ibid. 

33  Hogue  and  Bea,  Federal  Emergency  Management  and  Homeland  Security  Organization:  Historical 
Developments  and  Legislative  Options,  4. 
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definitions.34  It  did  not,  however,  stipulate  which  of  the  definitions  was  right,  more 
accurate,  or  most  appropriate.  Very  few  academic  or  practitioner  documents  attempt  to 
delineate  or  discern  between  these  terms  and  concepts,  and  even  fewer  attempt  to  define 
the  specific  roles,  responsibilities,  authorities,  or  discipline  differences  inherent  within 
each. 

George  Haddow,  Jane  Bullock,  and  Damon  P.  Coppola  have  written  a 
comprehensive  book  titled  Introduction  to  Emergency  Management  which,  as  of  2013,  is 
now  in  its  fifth  edition.35  These  authors  have  over  100  years  of  combined  experience  in 
the  profession  of  emergency  management  at  all  levels  including  senior  FEMA  positions. 
In  their  book,  they  state,  “The  definition  of  emergency  management  can  be  extremely 
broad  and  all  encompassing.  Unlike  other,  more  structured  disciplines,  it  has  expanded 
and  contracted  in  response  to  events,  congressional  styles,  and  leadership  styles.”36  They 
continue  to  provide  a  “simple”  definition  of  emergency  management  as,  “a  discipline  that 
deals  with  risk  and  risk  avoidance.”37  Then  they  add,  “Risk  represents  a  broad  range  of 
issues  and  includes  an  equally  diverse  set  of  players.”38  Additionally,  in  the  forward  for 
this  book,  a  letter  is  written  by  James  Lee  Witt,  the  former  director  of  FEMA,  which 
describes  emergency  management  as  a  discipline,  and  promotes  a  philosophy  of  risk 
reduction  and  community  protection.39  This  description  introduces  the  question  of 
difference  between  risk  managers  and  emergency  managers.  Lastly,  in  the  introduction, 
Haddow,  Bullock,  and  Coppola  state  that  emergency  management  is  a  profession  and  an 
academic  discipline.40  However,  the  table  of  contents  breaks  emergency  management  in 


34  Wayne  B.  Blanchard,  Guide  to  Emergency  Management  and  Related  Terms,  Definitions,  Concepts, 
Acronyms,  Organizations,  Programs,  Guidance,  Executive  Orders,  &  Legislation  (Washington,  DC: 
FEMA,  Emergency  Management  Institute,  2008). 

35  George  Haddow,  Jane  Bullock,  and  Damon  P.  Coppola,  Introduction  to  Emergency  Management 
(United  Kingdom:  Butterworth-Heinemann,  2013). 

36  Ibid.,  1. 

37  Ibid.,  2. 

38  Ibid. 

39  Ibid.,  forward. 

40  Ibid.,  xvii. 
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to  five  “disciplines,”  mitigation,  communication,  preparedness,  response,  and  recovery.41 
Ultimately,  while  this  book  is  a  tremendous  resource  for  understanding  the  profession  of 
emergency  management,  it  has  many  term  inconsistencies  and  does  little  to  discern  the 
difference  between  the  profession  and  the  discipline  of  emergency  management,  or  more 
specifically,  what  emergency  manager’s  roles,  authorities,  and  responsibilities  are.  It 
maintains  a  broad  and  all-encompassing  perspective  of  the  realm  of  emergency 
management. 

Haddow,  Bullock,  and  Coppola  reference  a  2009  Office  of  the  Inspector  General 
(OIG)  (OIG-09-25)  report  and  testimony  given  by  Donald  F.  Kettl  about  whether  FEMA 
should  be  in  Department  of  Homeland  Security  (DHS),  which  states,  “The  well- 
recognized  cycle  of  emergency  management  includes  preparedness,  response,  recovery, 
and  mitigation.”42  This  statement  is  an  interesting  promotion  of  the  four  phases  of 
emergency  management.  However,  the  report  then  continues  to  critique  notions  of  a  two- 
phase  approach  that  would  include  crisis  management  and  consequence  management.43  It 
then  cites  a  Hart-Rudd  Commission  Report  that  states  that  a  distinction  between  crises 
management  and  consequence  management  as  two  separate  efforts  is  neither  sustainable 
nor  wise,  as  it  creates  a  duplicative  command  structure  which  creates  confusion  and 
delay.44  It  finally  states  that  if  FEMA  was  removed  from  DHS,  then  DHS  would  lose 
preparedness  and  response  capability.45  It  is  interesting  that  recovery  and  mitigation  are 
not  listed  as  key  functions  that  might  be  lost. 

Perhaps  one  of  the  more  intriguing  excerpts  of  the  OIG  report  is  one  in  which  the 
author  cites  an  argument  by  Michael  Chertoff  (former  Director  of  DHS)  that: 

The  core  of  the  argument  made  about  FEMA  is  that  somehow  FEMA’s 
involved  with  consequence  management,  dealing  with  the  response,  and 
DHS,  in  other  respects,  is  dealing  with  preventing  or  protecting  against  a 


41  Haddow,  Bullock,  and  Coppola,  Introduction  to  Emergency  Management. 

42  Office  of  Inspector  General,  FEMA:  In  or  Out?  (OIG-09-25)  (Washington,  DC:  Department  of 
Homeland  Security,  2009),  https://www.oig.dhs.gov/assets/Mgmt/OIG_09-25_Feb09.pdf. 

43  Ibid. 

44  Ibid. 

45  Ibid. 
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response,  and  that  if  these  are  different  functions,  that  therefore  they  ought 
to  be  under  different  roofs,  and  I  really  beg  to  differ  with  that.  I  think  that 
is  a  profound  misunderstanding  of  how  one  plans  and  prepares  and 
executes  in  the  face  of  a  possible  emergency.46 

Kettl  further  adds,  “for  local  frontline  first  responders,  there  is  no  line  between  terrorist 
and  nonterrorist  hazards;  first  responders  must  focus  on  all-hazards -plus.  The  federal 
approach  and  structure  should  match  the  local  approach.  Separation  would  create  deep 
fissures  between  national  policy  and  the  realities  of  local  response.”47  This  viewpoint 
seems  to  be  flawed  logic,  however,  since  in  every  planning  effort,  various  disciplines  and 
organizations  are  always  involved  in  representing  various  roles  and  responsibilities  across 
all  four  phases  of  emergency  management,  and  neither  at  the  local  level  nor  the  federal 
level  does  it  make  sense  to  try  and  force  all  those  disciplines,  functions,  organizations, 
etc.,  under  the  same  departmental  roof.  Each  organization,  agency,  entity,  and  discipline 
needs  to  think  about  how  it  prepares,  responds,  recovers,  and  mitigates  within  its  distinct 
roles  and  responsibilities. 

In  an  article  making  the  case  for  emergency  management  as  a  profession,  David 
T.  Crews  states,  “In  their  primary  and  ‘strategic’  roles,  emergency  managers  must 
analyze  the  threat  to  economic  and  population  centers;  determine  the  significance  of  that 
threat,  gauge  the  potential  scope  of  the  threat  (size  and  impact);  provide  threat  frequency 
and  provide  a  course  of  action  (emergency  operations  plan)  for  governing  bodies.”48  He 
does  not  state  how  it  is  to  be  accomplished,  or  whether  emergency  managers  facilitate 
this  process  through  the  collaboration  of  various  disciplines  or  through  an  autonomous 
approach.  In  other  words,  he  does  not  explain  whether  the  emergency  managers  are  the 
doers  or  the  coordinators  and  facilitators.  He  goes  on  to  state,  “Emergency  managers  are 
also  required  to  tactically  respond  in  support  of  the  Emergency  Operations  Plan  when 
circumstances  dictate.  They  are  often  in  charge  of  Emergency  Operations  Centers  (EOCs) 

46  Remarks  by  Homeland  Security  Secretary  Michael  Chert  off  at  Johns  Hopkins  University,  December 
3,  2008.  As  cited  in:  Office  of  Inspector  General,  FEMA:  In  or  Out?  (OIG-09-25)  (  Washington,  DC: 
Department  of  Homeland  Security,  2009),  https://www.oig.dhs.gov/assets/Mgmt/OIG_09-25_Feb09.pdf. 

47  Office  of  Inspector  General,  FEMA:  In  or  Out?. 

48  David  T.  Crews,  “The  Case  for  Emergency  Management  as  a  Profession,”  Australian  Journal  of 
Emergency  Management,  Sydney,  Australia,  2001,  http://www.em.gov.au/Documents/case_for_emer 
gency_management_as_a_profession.pdf. 
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with  critical  information  and  communications  resources  during  large  disasters  and 
catastrophes.”49  Crews  makes  an  interesting  distinction  between  the  strategic 
responsibilities  and  the  tactical  responsibilities  that  are  not  seen  in  many  documents.  He 
does  state  that  emergency  managers  are  in  charge  of  EOCs,  which  is  interesting  and 
could  probably  be  debated  in  many  local  jurisdictions  where  emergency  managers  simply 
coordinate  activities  in  EOCs  and  have  little  to  no  authority. 

In  a  2007  empirical  study  on  the  changing  roles  and  responsibilities  of  the  local 
emergency  manager,  it  is  stated: 

Prior  to  2002  emergency  management  staff  spent  the  majority  of  their  time 
on  hazard  preparedness  projects  but  this  time  allocation  shifted 
dramatically  when  a  variety  of  federal  homeland  security  grants  became 
available  to  state  and  local  governments.  This  shift  in  responsibilities  may 
be  a  sign  that  domestic  security  concerns  have  supplanted  the  all-hazards 
approach  to  emergency  management  at  the  local  level.50 

Of  course,  it  further  states,  “it  may  also  be  a  product  of  the  manner  in  which  federal 
homeland  security  grants  are  administered  and  the  dynamics  of  the  intergovernmental 
structure  of  emergency  management  in  the  U.S.”51  Whether  or  not  the  activities  of  the 
local  emergency  manager  have  shifted  is  not  as  important  as  the  appropriateness  of  the 
actions  in  regards  to  what  the  roles  and  responsibilities  should  be. 

In  the  opening  sentence  of  his  article,  ‘“Crisis’  in  the  International  Encyclopedia 
for  Social  Sciences,”  James  A.  Robinson  states,  “‘Crisis’  is  a  lay  term  in  search  of  a 
scholarly  meaning.’”52  Patrick  Lagadec,  in  his  study,  Preventing  Chaos  in  a  Crisis, 
Strategies  for  Prevention,  Control  and  Damage  Limitation,  states,  “the  scholar  must 
admit  to  the  decision  maker  that  he  or  she  is  struggling  with  the  omnipresent  yet 
ephemeral  idea  of  crisis,  a  concept  that  seems  more  like  a  mirage  than  a  scientific  tool.”53 

49  Crews,  “The  Case  for  Emergency  Management  as  a  Profession.” 

50  Steven  D.  Stehr,  “The  Changing  Roles  and  Responsibilities  of  the  Local  Emergency  Manager:  An 
Empirical  Study,”  International  Journal  of  Mass  Emergencies  and  Disasters  25,  no.  1  (2007):  37-55, 
http://seareh.proquest.eom/doeview/6 1 699429  ?accountid=  1 2702. 

5^  Ibid. 

52  Robinson,  “Crisis,”  510-514. 

53  Patrick  Lagadec,  Preventing  Chaos  in  a  Crisis,  Strategies  for  Prevention,  Control  and  Damage 
Limitation,  trans.,  Jocelyn  M.  Phelps  (Maidenhead/Berkshire,  UK:  McGraw-Hill,  1993). 
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He  goes  on  to  describe  that  analysts  too  are  in  distress  on  the  matter  “because  the 
concepts  are  so  vague,  there  is  no  clearly  stated  theory.”54  Additionally,  (according  to 
Lagadec)  Wolf-Dieter  Eberwein  of  the  University  of  Bielefeld  in  Germany  has  called  for 
a  more  disciplined  use  of  the  term  crisis  stating,  “Concept  formation  in  theory 
construction  is  basic  because  we  thus  fix,  with  the  necessary  precision,  the  meaning  of 
the  terms  we  wish  to  designate  the  phenomena  we  want  to  explain.”55 

In  Lagadec’ s  study,  Preventing  Chaos  in  a  Crisis,  Strategies  for  Prevention, 
Control  and  Damage  Limitation ,  he  states,  “The  issue  of  definitions  probably  creates  the 
greatest  discomfort  in  the  face  of  the  wealth  of  proposals.”56  He  then  outlines  several 
definitions  of  crisis,  most  of  which  are  organizational  in  nature,  many  of  which  are  just 
symptom  descriptions,  and  a  couple  sociological  examples  peppered  in.57  In  the  end, 
Lagadec  proposes  three  primary  factors  for  crisis:  the  tidal  wave  ( crisis  =  an  emergency 
that  ovem’helms  problem-solving  resources),  disruption  ( crisis  =  the  system  threatens  to 
crumble ),  and  breakdown  ( crisis  =  the  familiar  world  threatens  to  collapse ).58 

Lagadec’s  description  of  crisis  helps  to  define  what  events,  issues,  and 
characteristics  crisis  managers  seek  to  address  and  manage.  However,  if  all  the  elements 
of  Lagadec’s  definition  must  be  met  before  something  can  be  defined  a  crisis,  then  the 
definition  begs  the  question,  if  the  crisis  can  be  managed,  then  is  it  in  fact  a  crisis  at  all? 
Lagadec’s  study  also  further  stresses  the  difficulty  in  trying  to  define  crisis  and  crisis 
management. 

Despite  the  gelatinous  and  somewhat  ephemeral  nature  of  defining  the  term  and 
concept  of  crisis,  several  authors  have  concocted  their  own  descriptions  and  definitions. 
One  example  from  the  book,  Coping  with  Crisis:  The  Management  of  Disasters,  Riots 

54  Lagadec,  Preventing  Chaos  in  a  Crisis,  Strategies  for  Prevention,  Control  and  Damage  Limitation. 

55  Wolf-Dieter  Eberwein,  “Crisis  Research,  The  State  of  the  Art:  A  Western  View,”  in  International 
Crises  and  Crisis  Management.  An  East-West  Symposium  (New  York,  London:  Praeger  Publishers, 

Sydney,  Toronto,  1978),  126-142. 

56  Lagadec,  Preventing  Chaos  in  a  Crisis,  Strategies  for  Prevention,  Control  and  Damage  Limitation, 
30. 

57  Ibid. 

58  Ibid.,  40. 
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and  Terrorism,  defines  crisis  as,  “a  serious  threat  to  the  basic  structures  of  the 
fundamental  values  and  norms  of  a  system,  which  under  time  pressure  and  highly 
uncertain  circumstances  necessitates  making  vital  decisions.”59  This  definition  is  also  the 
basis  for  the  book,  The  Politics  of  Crisis  Management  by  Arjen  Boin,  Paul  ‘t  Hart,  Eric 
Stem,  and  Bengt  Sundelius.60  Boin,  ‘t  Hart,  Stem,  and  Sundelius  consider  three  key 
components  to  the  definition  of  crises:  threat,  uncertainty,  and  urgency.61  The  book 
continues  to  present  crisis  management  as  a  highly  conceptual  process  of  sense  making 
and  decision  making  during  any  number  of  events.  They  admit  that  their  definition  of 
crises  is  an  “academic  shortcut  on  the  way  to  understanding  crisis  management,”62  and 
they  claim  to  be  “aware  that  the  management  of  crisis  may  depend  on  the  type  of 
threat.”63  Additionally,  they  claim,  “The  Strategic — as  opposed  to  the  tactical  or 
operational — challenges  for  leaders  in  dealing  with  various  threats  are  essentially  the 
same.”64  This  claim  relegates  their  definition  of  crisis  management  to  the  strategic  realm 
and  leaves  people  to  wonder  what  the  consistent  operational  and  tactical  methods  of  crisis 
management  may  be. 

In  the  book,  Managing  Crises:  Responses  to  Large-Scale  Emergencies,  Arnold 
Howitt  and  Herman  Leonard  posit  two  types  of  emergencies  exist,  routine  and  novel.65 
According  to  the  book,  crisis  management  must  be  accomplished  in  novel  emergencies.66 
They  further  detail  the  characteristics  of  and  competencies  necessary  for  managing  novel 


59  Uriel  Rosenthal,  Michael  T.  Charles,  and  Paul  ‘t  Hart,  Coping  with  Crises:  The  Management  of 
Disasters,  Riots,  and  Terrorism  (Springfield,  IL:  Charles  C  Thomas  Pub  Ltd.,  1989). 

66  Arjen  Boin,  The  Politics  of  Crisis  Management:  Public  Leadership  under  Pressure  (Cambridge, 
UK:  Cambridge  University  Press,  2005). 

61  Ibid. 

62  Ibid.,  4. 
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65  Arnold  M.  Howitt  and  Herman  B.  Leonard,  ed..  Managing  Crises:  Responses  to  Large-scale 
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events  and  crises  and  the  differences  between  the  competencies  and  characteristics 
necessary  for  routine  emergencies.67  They  provide  the  following  framework  in  Figure  2. 


Response  mode 

Characteristics 

Mode  R  (routine  emergencies) 

Mode  C(Crises) 

Situational  Awareness 
and  Expertise 

High 

Low,  but  openness  to 
recognizing  novelty  is  necessary 

Decision  Making 

Rapid  and  recognition  primed 

Cognitively  driven,  analytic 

Scripts 

Comprehensive 

Unavailable 

Customization 

Modest 

Extensive 

Skills  Required 

Well-defined,  highly 
developed 

Incompletely  specified,  but  creativity 
and  improvisational  ability  are  important 

Leadership 

Trained,  practiced,  and 
selected  for  prior  training 
and  performance 

Adaptive,  comfortable  sharing 
authority,  skilled  in  eliciting  ideas 
from  the  team,  and  innovative 

Command  Presence 

Authority-based, 

directive 

Muted,  oriented  toward 
collaboration  in  developing  solutions; 
more  hierarchical  in  execution 

Organizational  Structure 

Hierarchical 

Flattened  for  solution  development; 
more  hierarchical  for  design; 
hierarchical  for  execution 

Execution 

Aims  for  precision  through 
repeated  opportunities  for 
application  of  routine  practices 

Must  be  fault-tolerant  because 
solutions  have  been  improvised  and 
are  thus  not  fully  tested  or  practiced 

Figure  2.  Emergency  Response  Mode  Characteristics.68 


This  framework  certainly  helps  in  crisis  identification  based  on  Howitt  and 
Leonard’ s  definition  of  the  term.  However,  this  description,  and  the  concepts  in  the  book, 
are  more  conceptual  and  strategic  in  regards  to  sense  making  and  novelty  identification.  It 
seems  to  be  primarily  a  cautionary  tale  about  inflexibility  in  the  face  of  chaos, 
uncertainty,  and  novelty.  This  literature  did  not  do  any  favors  in  identifying  exactly  who 
crisis  or  emergency  managers  are,  as  well  as  their  respective  authorities  or  roles  and 
responsibilities.  In  the  study,  “Crisis  Management  Competencies:  The  Case  of 
Emergency  Managers  in  the  USA,”  Montgomery  Van  Wart  and  Naim  Kapucu  further 
elaborate  on  the  difficulties  in  modern  definitions  of  crisis  and  crisis  management  by 
stating: 

67  Howitt  and  Leonard,  ed..  Managing  Crises:  Responses  to  Large-scale  Emergencies. 

68  Source:  Ibid.,  620. 
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Some  confusion  is  induced  in  this  area  because  of  different  preferences  in 
nomenclature  between  the  private  and  public  sectors.  In  the  private  sector, 
the  term  crisis  management  is  often  used  very  broadly  to  mean  the 
prevention  and  response  to  all  untoward  events — regardless  of  severity, 
scope,  anticipation,  and  so  on...  This  is  now  sometimes  included  in 
expanded  definitions  of  risk  management  and  business  continuity 
strategies.69 

Van  Wart  and  Kapucu,  however,  do  a  great  job  of  bounding  the  domain  of  crisis 
management.70  They  provide  the  following  diagram  in  Figure  3  as  examples  of  change  as 
a  function  of  scope  and  speed. 


Slow  to  Moderate  Speed  of  Change 

Relatively  Fast  Change 

Planned 

Reactive  or 
evolutionary 

Planned 

Reactive  or  forced 

Limited  Scope  of 
Change 

Reengineering 

Ad  hoc  change 

Problem  solving 

Crisis  management 

Major  Scope  of 
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Figure  3.  Change  Event  Characteristics  and  Types.71 


Through  the  above  chart  and  elaboration  Van  Wart  and  Kapucu  do  a  great  job  of 
identifying  that  not  all  sudden  threats  to  organizational  status  quo  are  actually  crises,  nor 
do  they  all  require  crisis  management.  Their  identification  of  relatively  fast  reactive  or 
forced  change  with  a  limited  scope  being  where  crisis  management  occurs  helps  to  apply 
crises  management  and  crises  managers  to  more  traditional  organizational  structures. 
Another  important  distinction  they  make  is  that  crisis  management  “is  related,  but  not 
identical,  to  emergency  management,  change  management,  and  transformational 
leadership.”72  They  define  crisis  management  as: 


69  Montgomery  Van  Wart  and  Naim  Kapucu,  “Crisis  Management  Competencies:  The  Case  of 
Emergency  Managers  in  the  USA,”  Public  Management  Review  13,  no.  4  (201 1):  491. 

70  Ibid.,  489-511. 

71  Source:  Ibid.,  495. 

72  Ibid.,  491. 
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A  special  type  of  change  management  typified  by  surprise  (or  uncertainty 
in  planning  context)  due  to  unexpectedness  or  size  of  an  incident,  short 
time  frame,  and  criticality  in  terms  of  life-and-death  consequences  or 
organizational  threat.  Crisis  refers  to  the  organization  being  significantly 
damaged  or  being  unable  to  respond  coherently  or  effectively.  When  this 
occurs  to  an  emergency  management  agency  because  of  a  very  large 
event,  it  is  usually  called  disaster  or  catastrophe  management.  While 
emergency  management  agencies  rarely  have  sufficient  resources  to  fully 
anticipate  all  catastrophes,  good  contingency  planning  as  well  as 
interagency  exercises  and  coordination  with  political  leaders  can  alleviate 
the  severity  of  disasters  enormously,  or  conversely  if  lacking,  seem  to 
make  matters  worse.73 

The  findings  of  Van  Wart  and  Kapucu’s  study  indicate  that  senior  emergency 
managers  in  administrative  leadership  positions  do  not  “abandon  emergency  management 
practices  during  crises,  but  rather  adapt  them  selectively.”74  However,  their  definition  of 
emergency  managers  and  emergency  management  is  somewhat  muddled  including  a 
rather  large  category  of  practitioners  and  leaders.  They  define  emergency  management 
and  disaster  management  synonymously  as: 

Avoiding  and  dealing  with  risks.  At  its  best,  it  prevents  or  minimizes 
emergencies,  and  then  routinely  handles  emergencies  with  plans,  training, 
and  resources  when  they  do  happen.  This  field  involves  many  areas  in  the 
public  sector,  notably  public  safety  departments,  emergency  management, 
flood  control,  etc.  Because  timely  response  in  incidents,  emergencies  and 
disasters  is  critical,  the  routinization  of  response  through  training  and 
drills  provides  much  needed  efficiency.  Part  of  risk  and  emergency 
management  is  the  development  of  contingency  plans  for  when  the  system 
malfunctions,  or  for  unusual-but-possible  scenarios,  in  particular 
catastrophes.75 

When  comparing  the  two  definitions,  while  Van  Wart  and  Kapucu  provide  for 
crisis  management  and  emergency  management,  a  few  interesting  issues  are  presented. 
The  first  is  that  emergency  managers  are  identified  as  being  only  one  of  several  “areas” 
involved  in  emergency  management.76  It  states  that  emergency  management  “handles 


73  Van  Wart  and  Kapucu,  “Crisis  Management  Competencies:  The  Case  of  Emergency  Managers  in 
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emergencies  with  plans,  training,  and  resources,”77  but  then  does  not  state  which  “area” 
does  which.  Also,  the  fact  that  it  describes  emergency  and  disaster  management 
synonymously  but  then  specifically  states,  “Crisis  refers  to  the  organization  being 
significantly  damaged  or  being  unable  to  respond  coherently  or  effectively.  When  this 
occurs  to  an  emergency  management  agency  because  of  a  very  large  event,  it  is  usually 
called  disaster  or  catastrophe  management .”78  This  statement  leads  to  the  belief  that 
disaster  management  is  different  from  emergency  management,  or  that  emergency 
management  transforms  into  disaster  management  when  the  traditional  emergency 
management  capabilities  are  not  sufficient.  Furthermore,  earlier  in  the  document,  they 
state: 


In  the  public  sector,  in  which  a  significant  portion  of  the  agencies, 
personnel,  and  resources  are  devoted  to  this  purpose,  untoward  events  that 
are  planned  for  are  called  emergencies  and  disasters,  and  therefore  the 
effort  to  plan  and  respond  to  untoward  events  -  natural  and  manmade  -  is 
called  emergency  management.  Crisis  and  catastrophes  have  a  special 
meaning,  suggesting  that  the  system  has  been  overwhelmed  or  taken  off 
guard  and  outside  resources  and  the  concomitant  external  coordination  are 
necessary  for  effective  response  and  recovery.79 

Still,  they  had  already  said  that  when  an  emergency  management  structure  is 
overwhelmed,  it  is  called  disaster  management,  not  crisis  management.  This  statement  is 
not  entirely  accurate,  however,  since  emergency  management  structures  often  activate  to 
support  emergency  management  structures  in  political  sub-divisions  that  have  been 
overwhelmed  (counties  supporting  cities,  for  example).  In  other  words,  by  Van  Wart  and 
Kapucu’s  definitions  and  logic,  one  jurisdiction’s  emergency  might  be  a  lower 
jurisdiction’s  disaster.  Furthermore,  it  describes  disaster  and  emergency  management 
synonymously  but  then  states  that  disaster  management  is  what  happens  when  emergency 
management  is  overwhelmed.80  They  cannot  be  synonymous  if  emergency  management 
and  crisis  management  are  specifically  identified  as  different,  and  the  definition  for  crisis 

77  Van  Wart  and  Naim  Kapucu,  “Crisis  Management  Competencies:  The  Case  of  Emergency 
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management  is  when  disaster  management  occurs.  These  definitions  and  descriptions 
also  seem  to  go  back  and  forth  between  inferences  to  a  process,  a  system,  or  an 
organization  of  emergency  management. 

While  Van  Wart  and  Kapucu  “seek  to  clarify... distinct  concepts  that  are  related 
but  often  blurred,”81  it  would  seem  they  still  leave  some  related  concepts  somewhat 
blurred.  While  they  do  highlight  some  key  competency  differences  between  emergency 
managers  and  crisis  managers,  they  do  little  to  define  the  specific  roles,  responsibilities, 
or  authorities  of  these  differing  positions.  They  do  provide  great  value  in  bounding  the 
domain  of  crises  management  activities,  as  well  as  in  demonstrating  that  crisis 
management  is  not  solely  the  activity  or  realm  of  the  public  sector,  but  also  necessary  in 
the  private  sector. 

Christoph  Roux-Dufort  argues  in  his  article,  “Is  Crisis  Management  (Only)  a 
Management  of  Exceptions?,”  that  crisis  management  has  heretofore  limited  itself  to  the 
analysis  of  exceptional  situations,  and  in  doing  so,  has  isolated  itself  from  mainstream 
organizational  theory.82  He  cautions  that  should  the  study  of  crises  not  “go  beyond  the 
sphere  of  exception  management”  that  it  will  continue  to  “remain  an  isolated  discipline 
with  little  room  for  innovation  and  progress.”83  The  study  proposes  seeing  crises  as  a 
process  of  incubation  for  organizational  change  and  transformation  through  reevaluation 
of  three  suppositional  factors:  reassigning  the  triggering  point,  seeing  crises  as  temporal 
events,  thus  removing  common  perceptions  of  and  associations  with  urgency,  and  seeing 
a  crisis  as  a  surge  of  meaning  as  opposed  to  a  collapse  of  meaning,  as  is  the  commonly 
held  perspective.84  He  blames  the  isolation  of  crisis  management  as  a  discipline  on  four 
primary  factors:  crisis  being  used  as  an  alibi,  crisis  being  poorly  defined,  crisis  being 
affiliated  entirely  with  accidents,  and  (somewhat  in  summary  of  the  previous  three)  crisis 
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becoming  the  science  of  the  exceptional.85  He  proposes  a  conceptual  paradigm  change 
away  from  seeing  crisis  as  an  event  but  instead  to  see  it  as  a  process.86  Perhaps  most 
controversial,  he  proposes  that  through  a  processual  perspective  of  crisis,  individuals 
quickly  see  that  victims  of  crisis  are  in  fact  culprits,  simply  speeding  up  a  pre-existing 
dynamic.87  Furthermore,  while  praising  the  relevance  of  their  work,  he  accuses  Patrick 
Lagadec  and  Urial  Rosenthal  (referenced  earlier  in  this  literature  review  section)  of 
substitution  and  semantic  escalation  by  interchanging  the  terms  rupture  and 
inconceivability  with  crisis,  thus  “widening  the  distance  between  crises  management  and 
preoccupation  of  managers  and  organization  theorists.”88 

Roux-Dufort  provides  a  surprisingly  counter-culture  perspective  on  crisis  and 
crisis  management.  It  serves  as  an  interesting  exercise  to  see  crisis  as  a  process  instead  of 
an  event.  It  demonstrates  value  in  defining  crisis  and  crisis  management  in  such  a  way  as 
to  bring  organizational  theory  and  crisis  theory  in  to  greater  harmony.  More  than 
anything,  this  article  reinforces  the  fact  that  crisis  and  crisis  management  (and  crisis 
managers  more  specifically)  lack  clear  definition  and  specificity. 

Ultimately,  the  academic  and  practitioner  literature,  while  all  tremendous  and 
relevant,  only  serves  to  muddy  the  waters  in  regards  to  the  specific  definition  and 
delineation  of  the  roles,  responsibilities,  and  authorities  of  emergency  managers,  crisis 
managers,  incident  managers,  incident  responders,  risk  managers,  business  continuity 
specialists,  and  preparedness  coordinators.  All  the  literature  reviewed,  as  well  as  many 
other  sources  reviewed  and  not  included  in  this  thesis,  seem  to  confuse  terms,  use 
definitions  interchangeably,  obfuscate  specificity,  and  purposely  broaden  domains  and 
relevance.  While  many  would  seek  to  define  competencies  for  professionals  with  these 
various  titles,  it  seems  premature  without  first  defining  the  appropriate  specific  mission 
space,  roles,  responsibilities,  and  authorities  for  each.  Furthermore,  defining  specifically 
what  aspects  of  each  of  these  are  disciplines  or  professions  seems  to  be  unclear. 

85  Roux-Dufort,  “Is  Crisis  Management  (Only  )  a  Management  of  Exceptions?,”  105-114. 

86  Ibid. 

87  Ibid. 

88  Ibid. 


38 


Regarding  crisis  and  crisis  management,  the  common  preeminent  perspectives 
seem  to  place  the  responsibility  of  crisis  management  on  the  person  or  organization  that 
the  crisis  is  happening  to,  like  people  in  the  middle  of  a  psychological  breakdown  acting 
as  their  own  therapist.  This  perspective  seems  like  a  foolhardy  approach  to  define  or 
operate  as  a  crisis  manager,  and  actually  creates  a  bit  of  a  paradox,  as  many  definitions  of 
crisis  have  elements  describing  them  as  unmanageable.  It  seems  more  appropriate  to  view 
crisis  managers  as  an  outside  force  who  attempt  to  stabilize,  marginalize,  or  isolate  a 
crisis  from  the  outside,  especially  if  that  external  crisis  stands  as  a  threat  to  their  own 
organization  or  capability. 

C.  LITERATURE  REVIEW  CONCLUSIONS 

After  reviewing  the  extent  federal,  state,  and  local  doctrine,  grants  guidance, 
professional  association  guidance,  accreditation  and  training  institution  guidance,  and  the 
academic  and  practitioner  literature  available  on  the  topics  of  emergency  management, 
crisis  management,  incident  management,  incident  response,  community  preparedness, 
business  continuity,  and  risk  management,  much  is  left  unclear  and  in  obfuscation. 
However,  several  findings  and  areas  of  needed  definition  and  exploration  were  identified. 
The  findings  of  this  literature  review  fall  into  the  following  seven  topics. 

•  Much  is  written  about  what  emergency  management  does,  but  little  about 
what  emergency  management  does  not  do.  The  term  emergency 
management  is  often  broadly  used  as  a  catch-all  to  define  everything  and 
everyone  having  anything  to  do  with  incident  management,  and  these  two 
terms  are  often  used  interchangeably.  It  is  never  clear  if  emergency 
management  is  part  of  incident  management,  or  crisis  management;  nor  is 
it  clear  if  it  is  the  other  way  around,  or  some  other  combination. 
Additionally,  it  seems  to  be  of  great  confusion  how  much  emergency 
management  emergency  managers  specifically  are  responsible  for,  or  have 
authority  over.  Once  again,  emergency  managers  are  often  identified  as 
having  great  scope  and  responsibility,  where  other  times,  emergency 
managers  seem  to  be  left  out  of  emergency  management  all  together 
where  emergency  management  is  seen  as  a  process  effectively  carried  out 
by  various  disciplines  and  agencies  without  emergency  manager 
involvement.  Much  clarity  and  domain  bounding  is  needed  in  every 
category  of  this  literature  review. 

•  The  phases  of  emergency  management  seem  to  be  under  suppositional 
debate,  if  not  overt  debate.  Whether  there  are  two  phases  of  emergency 
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management  (crisis  management,  consequence  management),  three  phases 
(preparedness,  response,  recovery),  four  phases  (preparedness,  response, 
recovery,  mitigation),  five  phases  (prevention,  preparedness,  response, 
recovery,  mitigation),  or  six  phases  (protection,  prevention,  preparedness, 
response,  recovery,  mitigation)  seems  to  be  under  debate.  While  four 
phases  seems  to  be  the  predominate  list,  several  documents  passively 
identify  and  presuppose  or  argue  for  each  of  the  options  previously  listed. 
Definitive  clarity  and  is  needed  in  every  category  of  the  literature  review. 

•  Specific  differences  and  delineation  between  the  various  roles, 
responsibilities,  authorities,  mission  spaces,  and  jurisdictions  of  incident 
responders,  incident  managers,  incident  commanders,  crisis  managers, 
emergency  managers,  preparedness  coordinators,  risk  managers, 
mitigation  specialists,  and  business  continuity  specialists  is  not  found 
uniformly  or  disparately  in  any  of  the  documents  in  this  literature  review. 

•  DOCs  are  not  addressed  well  enough  in  the  most  common  national 
incident  management  guiding  doctrine,  which  may  be  inadvertently 
propagating  a  conceptual  gap  between  tactical  and  support  mechanisms 
and  allowing  for  inappropriate  mission  creep  during  incident  management 
operations. 

•  Doctrine  is  lacking  in  outlining  the  differences  between  strategic, 
operational,  and  tactical  incident  management  activities  and  what 
functions  have  the  lead  on  which. 

•  Appropriate  KSAs  are  extremely  difficult  to  define  for  the  various 
emergency  and  crisis  management  variants  due  to  the  aforementioned 
findings,  thus  making  effective  performance  metrics,  training,  and 
education  very  difficult  to  establish  in  the  realm  of  incident  management. 

•  The  current  incident  management  doctrine  and  foundational  guidance  is 
composed  of  not  one  but  various  doctrinal  sources,  created  by  various 
disparate  entities  and  agencies  seemingly  not  in  complete  cooperation, 
with  different  paradigm  influences,  with  disjointed  or  conflicting 
language,  without  a  clearly  stated  comprehensive  unifying  guiding  set  of 
principles  for  doctrine  creation,  and  is  not  comprehensive  as  it  does  not 
seem  to  address  all  the  potential  aspects,  concepts,  or  topics  of  the  incident 
management  enterprise  or  activities. 
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IV.  PROPOSED  INCIDENT  MANAGEMENT  CONCEPTUAL 

MODEL 


Not  until  terms  and  concepts  have  been  clearly  defined  can  one  hope  to 
make  any  progress  in  examining  the  question  clearly  and  simply  and 
expect  the  reader  to  share  one’s  views.89 


To  better  understand  incident  management  and  where  individuals  fit  within  the 
incident  management  enterprise,  it  is  necessary  to  define  the  various  components  of 
incident  management,  and  describe  the  various  interrelated  parts,  players,  places,  and 
concepts  that  make  up  incident  management,  its  process,  and  the  enterprise  at  large. 
Additionally,  when  endeavoring  to  discern  incident  management  intuitively  and 
comprehensively,  it  is  perhaps  most  advisable  to  establish  a  set  of  guiding  higher  order 
incident  management  truths,  or  principles,  as  a  foundation  or  springboard  to  be  applied 
comprehensively  to  the  entire  model.  After  conducting  the  in-depth  literature  review  and 
analysis,  and  practitioner  interviews,  it  became  apparent  that  a  consistent  set  of  higher 
order  incident  management  principles,  or  truths,  were  not  applied  consistently  or 
comprehensively  in  the  existing,  seemingly  disparate,  foundational  sources  of  incident 
management  doctrine.  The  literature  review  and  practitioner  interviews,  when  reviewed 
by  the  author  of  this  study,  brought  to  light  a  number  of  areas  or  categories  that  should  be 
addressed  for  an  incident  management  model  to  be  consistent  and  comprehensive,  and 
maintain  maximum  utility  for  the  practitioner.  The  following  short  list  of  guiding 
principles,  or  truths,  informs  the  various  components  and  aspects  of  a  newly  proposed 
comprehensive  incident  management  conceptual  model: 

•  A  model  should  be  designed  with  maximum  capacity,  ideal  resources,  and 
ideal  practitioner  competency  in  mind.  A  model  should  serve  as  a 
benchmark,  standard,  and  goal,  and  as  such,  should  be  designed  to  be  the 
ideal  end  product. 

•  Universal  application  should  be  the  cornerstone  of  an  incident 
management  model.  To  ensure  maximum  adoption,  consistent 
familiarization,  consistent  integration  and  application,  and  consistent 
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paradigm  framing,  the  model  should  be  developed  with  consistency  and 
universality  from  the  lowest  to  the  highest  levels. 

•  Clearly  bounded  mission  spaces,  roles,  responsibilities,  and  authorities 
need  to  be  defined  to  reduce  application  friction,  mission  creep,  and 
implementation  conflict. 

•  The  model  should  remain  as  simple  as  possible  and  avoid  cumbersome 
structures  and  options  to  ensure  the  feasibility  of  implementation  and 
consistency  of  adoption  amongst  all  practitioners. 

•  The  model  should  avoid  esoteric  concepts  and  should  focus  on 
pragmatism,  intuitiveness,  and  overall  simplicity. 

•  The  model  should  be  modular  and  component  driven  so  that  elements  can 
be  added  or  removed  where  necessary  and  unnecessary  or  redundant 
aspects  are  reduced  or  eliminated  in  the  interest  of  efficiency  and  efficacy. 

•  Incidents  are  managed  at  the  lowest  possible  level  and  all  incident 
management  components  serve  to  return  things  to  their  lowest  possible 
levels. 

•  A  comprehensive  incident  management  model  defines  and  describes  the 
event  types,  the  practitioners,  the  processes,  the  activities,  the 
competencies,  the  mission  spaces,  and  the  organizational  structures 
inherent  to  effective  incident  management. 

•  The  components  of  the  model  should  be  described  and  their  purpose  and 
logic  justified  ensuring  the  practitioner  has  an  understanding  not  just  of 
the  “what,”  but  also  of  the  “why.” 

•  To  ensure  maximum  conceptual  saturation,  the  incident  management 
model  should  contain  visual  diagrams  to  assist  the  practitioner  in  concept 
comprehension  to  help  ensure  consistent  application  and  understanding  of 
the  model  across  the  entire  incident  management  enterprise. 

The  following  topics  present  a  new,  more  holistic,  pragmatic  conceptual 
framework  and  model  for  understanding  and  defining  the  relationships  and  concepts  of 
the  major  incident  management  components  applying  the  higher  order  incident 
management  principles  previously  described.  This  conceptual  model  is  designed  to  be  a 
linear  inductive  Socratic  exploration  where  topics  are  introduced  and  broadly  discussed, 
then  the  individual  components  of  that  topic  are  given  a  proposed  definition,  and  a 
justification  for  the  definition  is  provided.  Each  topic  is  a  layer  building  upon  the 
understanding  and  logic  of  the  last.  Amongst  the  layers  of  topics  are  a  number  of 
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graphical  models  that  help  the  reader  conceptualize  and  understand  the  topics.  At  the  end, 
once  all  the  necessary  topics  have  been  explored,  a  number  of  fictional  examples  are 
provided  to  illustrate  the  implementation  of  this  model  followed  by  several  real-world 
case  examples. 

A.  STIMULUS  EVENT  TYPES 

As  presented  in  Figure  4,  the  stimulus  event  types  discussed  are  catastrophe, 
disaster,  emergency,  state-of-emergency,  incident,  crisis,  threat,  and  specific  active  threat. 
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This  figure  is  a  conceptual  diagram  of  the  various  incident  management  event  and 
stimulus  types.  It  applies  to  the  entire  stimulus  event  type  section.  Notice  specifically 
where  events  overlap,  and  their  relation  to  the  moment  an  incident  takes  place.  An 
incident  occurring  does  not  always  dictate  or  preclude  or  exclude  the  concurrent 
existence  of  another  particular  state  of  being,  stimulus  type,  or  event  classification. 

Figure  4.  Incident  Management  Event  Types 


Introduction:  It  can  be  extremely  difficult  to  discern  between  the  aforementioned 
terms  if  looking  to  existing  doctrine  and  literature.  As  an  example,  The  National 
Preparedness  Goal  states: 
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Communities  regularly  deal  with  emergencies  and  disasters  that  have 
fewer  impacts  than  those  considered  to  be  the  greatest  risk  to  the  Nation. 

In  addition,  communities  may  have  resident  capacities  to  deal  with  the 
public’s  needs  locally  for  many  of  these  lesser  incidents.  Catastrophic 
incidents  will  require  a  much  broader  set  of  atypical  partners  to 
accomplish  the  capability  targets  for  the  Response  core  capabilities  than 
those  routinely  addressed.90 

This  document  never  states  what  differentiates  a  disaster  or  emergency  from  a  “lesser 
incident”  or  a  “catastrophic  incident.”  Furthermore,  differences  occur  between 
proclaimed  local  emergencies,  proclaimed  states  of  emergency,  and  declared  disasters.91 
These  incidents  are  each  tied  to  levels  of  political  subdivision  and  financial 
reimbursement  eligibility.  Meanwhile,  the  definition  of  a  crisis  is  a  major  topic  of 
academic  debate  that  has  very  little  specific  meaning  or  definition  in  current  incident 
management  doctrine.  Crisis  and  threat  are  often  loosely  affiliated  with  law  enforcement 
and  security  activities  in  most  incident  management  doctrine. 

As  demonstrated  in  the  literature  review  and  analysis,  various  inconsistent  and 
interchangeable  uses  of  the  aforementioned  terms  exist.  This  persistent  trend  may  cause 
confusion  regarding  thresholds  of  various  incident  management  activities  amongst 
various  disciplines  and  practitioners.  While  these  terms  are  fairly  relative  when  used 
colloquially  or  figuratively,  in  relation  to  incident  management,  it  is  an  area  that  needs 
term  definition  and  consistency. 

The  following  definitions  are  proposed. 

1.  Catastrophe 

Catastrophes  are  a  series  of  cascading  human-caused  events  or  incidents,  the 
adverse  effects  or  consequences  of  which  are  potentially,  seemingly,  or  definitively 
irreversible.  A  catastrophe  may  be  caused  by  a  disaster,  or  may  be  the  cause  of  a  disaster. 


90  Michael  Chertoff,  National  Preparedness  Goal  (Washington,  DC:  Department  of  Homeland 
Security  (DHS),  2011,  11,  http://www.fema.gov/media-library-data/20130726-1828-25045-9470/national_ 
preparedness_goal_201 1  .pdf. 

91  Los  Angeles  County  Operational  Area,  Emergency  Proclamations  and  Disaster  Declarations  (Los 
Angeles,  CA:  Disaster  Management  Area  Coordinators  and  Los  Angeles  County  Office  of  Emergency 
Management,  2012),  http://www.  smgov.  net/departments/oem/ sems/proclamations-and-declarations/ 
emergency-proclamations-and-declaration-guide.pdf. 
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A  catastrophe  may  be  an  emergency  or  cause  a  state  of  emergency,  or,  an  emergency  or 
state  of  emergency  may  cause  a  catastrophe. 

Justification:  The  radiological  release  and  contamination  of  an  area  due  to  a 
tsunami  or  earthquake  exceeding  the  safety  design  parameters,  coupled  with  ineffective 
redundancy  measures,  might  be  an  example  of  a  catastrophe  caused  by  a  disaster.  Run 
away  greenhouse  effects  caused  by  human  influence  creating  rising  sea  levels,  increased 
hurricanes,  or  severe  coastal  flooding  might  be  an  example  of  a  catastrophe  causing 
disasters.  An  oil  spill  in  a  local  area  caused  by  a  series  of  safety  failures  responded  to 
with  local  resources  that  adversely  significantly  alter  a  local  eco-system  causing  the 
extinction  of  a  species  of  animal  or  plant  might  be  an  example  of  a  catastrophe,  which  is 
an  incident  but  not  an  emergency  (as  local  resources  were  not  overwhelmed).  A  massive 
oil  spill  causing  significant  environmental  harm,  destruction,  death,  or  extinction  that 
overwhelms  local  response  agencies  and  assets  requiring  outside  emergency  response 
resources  might  be  an  example  of  a  catastrophe  causing  an  emergency  or  state  of 
emergency.  Catastrophes  may  also  be  caused  by  or  cause  crises.  The  primary  component 
of  a  catastrophe  is  a  series  of  events  or  incidents  with  irreversible  adverse  effects  that  are 
human  caused  or  that  could  have  been  mitigated  by  human  actions  and  were  not,  or  that 
exceeded  several  levels  of  human  design  or  engineering  factors.  Catastrophes  may  be 
environmental,  economic,  technological,  etc. 

2.  Disaster 

A  disaster  is  any  natural  event  or  emergency,  or  (regardless  of  cause)  any  fire, 
flood,  or  explosion  that  warrants  major  federal  or  international  assistance. 

Justification:  The  primary  component  of  a  disaster  is  its  inherent  requirement  for 
federal  level  (or  international)  assistance.  This  aspect  denotes  a  level  of  severity 
appropriate  for  the  title.  Disasters  are  often  devastating  (financially,  environmentally,  or 
mortally)  not  just  to  the  local  area  of  impact,  but  potentially  also  to  the  state,  nation,  or 
nations.  When  these  events  occur,  they  carry  a  level  of  seriousness  that  should  only  be 
titled  appropriately  as  a  disaster. 
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3.  Emergency 

An  emergency  is  an  incident  or  crisis  posing  a  threat  to  the  safety  of  persons, 
property,  or  the  environment  that  exceeds  an  organization’s  resources  or  capability. 

Justification:  The  primary  component  of  an  emergency  is  its  overwhelming 
nature.  By  the  very  nature  of  the  word  “emergency,”  it  becomes  non-routine.  The  simple 
existence  of  an  incident  or  crisis  does  not  inherently  denote  an  emergency;  many 
incidents  or  crises  could  be  considered  routine.  For  example,  a  car  accident  or  structure 
fire  in  a  jurisdiction  is  an  incident  that  does  not  likely  overwhelm  local  resources  or 
capabilities  and  could  be  considered  routine.  Equally,  a  crisis  like  a  labor  strike  or  non¬ 
crisis  event  like  changing  economic  factors  that  threaten  the  local  tax  base  and  affect 
long-term  organizational  change  do  not  necessarily  overwhelm  local  resources  or  denote 
an  emergency  or  state  of  emergency.  An  emergency  results  when  local  resources  are  not 
adequate  to  respond  to  life  safety,  property  damage,  or  environmental  damage  issues. 

4.  State  of  Emergency 

A  state  of  emergency  is  an  eminent  impending  incident  or  crisis  posing  a  threat  to 
the  safety  of  persons,  property,  or  the  environment  likely  to  exceed  resources  or 
capability  of  the  proclaiming  political  jurisdiction,  or,  the  existence  of  an  active  incident 
that  threatens  a  population  and  the  adequacy  of  local  resources  is  unknown. 

Justification:  A  state  of  emergency  may  exist  when  it  is  known  that  an 
impending  threat  will  definitely  overwhelm  local  resources  or  capabilities,  or,  if  it  is 
unknown  whether  local  resources  are  enough  to  manage  an  existing  incident.  For 
example,  if  a  wildfire  is  threatening  a  local  population  and  it  is  unclear  whether  the 
resources  that  have  been  applied  to  the  wildfire  response  are  enough  to  contain  it,  then  a 
state  of  emergency  may  be  in  effect  for  that  local  population.  Or,  if  an  active  shooter 
event  is  occurring  and  it  is  unknown  how  many  malicious  actors  are  involved  or  the 
scope  of  their  capabilities,  and  it  is  unknown  if  local  response  resources  will  be  adequate 
to  stop  the  threat,  then  a  state  of  emergency  may  be  in  effect. 


46 


5. 


Incident 


An  incident  is  the  physical  manifestation  of  a  crisis,  event,  or  occurrence  that  has 
adversely  affected  life,  property,  or  the  environment  requiring  the  response  of  at  least  one 
individual. 

Justification:  An  incident  may  be  a  relatively  small  or  routine  event,  as  small  as  a 
person  cutting  a  finger,  or  as  large  as  the  crash  of  the  Titanic.  One  or  several  incidents 
may  be  involved  in  an  emergency,  disaster,  or  catastrophe.  The  boundaries  of  an  incident 
can  be  recognized  by  the  directly  correlated  and  active  negative  impacts  or  consequences 
related  to  an  event  at  a  general  location  that  are  addressed  in  a  coordinated  manner  on¬ 
scene. 


6.  Crisis 

A  crisis  is  a  phenomenon,  event,  active  threat,  or  trend,  with  or  without  a  specific 
location  posing  seemingly  inevitable  harm  to  life,  property,  environment,  organizational 
performance,  reputation,  or  way  of  life  reasonably  or  ethically  necessitating  a  deliberate 
urgent  intervention.  (A  crisis  may  be  local,  national,  or  global) 

Justification:  Perhaps  the  most  controversial  and  difficult  definition,  a  crisis  is 
described  by  many  definitions.  Unfortunately  none  are  very  satisfying  in  relation  to 
incident  management  (see  literature  review).  Little  consensus  has  been  reached  for  what  a 
crisis  means  specifically.  It  seems  that  if  an  incident  has  not  yet  occurred,  but  a  known 
imminent  future  incident  or  potential  incident,  preventable  incident  caused  by  persistent 
or  systemic  conditions,  or  threat  to  an  organizational  structure,  state  of  seemingly 
harmonious  stability,  necessary  symbiotic  dependency,  or  cultural  paradigm  presents 
itself,  then  the  knowledge  of  the  threat  or  hazard’s  existence  and  its  consequences  is  the 
crisis  or  state  of  crisis,  or  an  exigency  (threatening  operation,  reputation,  or  existence) 
requiring  urgent  organizational  attention.  This  definition  alludes  to  moral  or  value 
imperative,  for  better  or  worse,  but  could  also  describe  operational,  economic,  or  other 
types  of  imperative  responses. 
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7. 


Threat 


A  threat  is  a  communicated,  demonstrated,  or  inferred  intent  and  potential 
capability  to  harm  life,  property,  environment,  organizational  performance,  or  way  of  life. 

Justification:  Threat  denotes  intent,  and  thus,  is  inherently  related  to  human 
factors.  The  general  state  of  being  under  threat  from  an  actor  or  actors  simply  denotes  the 
existence  of  malicious  intent  with  potential  capability  and  generally  communicated 
targets  without  knowledge  of  an  active  attempt  to  execute. 

8.  Specific  Active  Threat 

A  specific  active  threat  is  a  known  communicated,  demonstrated,  or  inferred 
timely  intent  and  capability  to  harm  life,  property,  environment,  organizational 
performance,  or  way  of  life  with  a  specified  or  unspecified  target. 

Justification:  Threat  denotes  intent,  and  thus,  is  inherently  related  to  human 
factors.  When  intelligence  indicates  actors  that  currently  possess  malicious  intent  to  cause 
damage,  harm,  or  disruption  to  something  that  they  feasibly  have  access  to,  in  fact,  have 
the  capabilities  or  tools  to  act  on  that  threat,  then  specific  active  protective  and 
preventative  measures  must  be  taken.  This  threat  is  different  from  a  non-specific  or  a 
non-active  threat  that  is  the  general  state  of  being  under  threat  from  an  actor  or  actors 
with  no  specifically  communicated  target  or  unknown  capabilities. 

B.  PRACTITIONERS 

Practitioners  include  emergency  responders,  crisis  responders,  incident 
responders,  incident  commanders,  incident  managers,  crisis  managers,  crisis  leaders, 
emergency  managers,  emergency  management  functional  representatives,  risk  managers, 
disaster  coordinators,  emergency  planners,  preparedness  specialists,  and  business 
continuity  specialists,  as  shown  in  Figures  5  and  6.  These  figures  are  conceptual  diagrams 
of  the  various  incident  management  practitioner  types  and  apply  to  the  entire  practitioner 
section,  but  are  also  used  in  later  sections  to  illustrate  other  incident  management 
components.  Notice  specifically  the  delineation  between  tactical,  operational,  and 
strategic  mission  focuses  amongst  the  varying  mission  areas,  and  the  applicable 


48 


practitioners.  Additionally,  notice  the  delineation  between  command  and  direction  in 
Figure  5. 


IM  Guiding  IM  Mission  Control  Primary 

Practitioners  Doctrine  Levels  Focus  Method  Activities 


Politicians 


Executives 


Emergency 

Managers 

Crisis 

Managers 


Incident 

Responders 


Law/Code/ 

Ordinances 

Departmental 

Policies 


NIMS/EOP 


Departmental 

Procedures 


ICS 


Political 


Policy 


Strategic 


Operational 


Tactical 


Leadership 


Advisory 


Coordination 


Direction 


Command 


Financing/Public 

Support/Laws 

Codifying 
Strategic  Methods 

Continuity  of 
Govt.  &  Strategic 
Coordination 

Moving  Resources 
Around 

Resources 
Fighting  the  Fight 


Figure  5.  Incident  Management  Levels. 
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Figure  6.  Incident  Management  Knowledge,  Skills  and  Abilities. 

Introduction:  Within  the  extent  incident  management  literature,  as  demonstrated 
within  the  literature  review,  inconsistency  occurs  in  the  definitions,  roles  and 
responsibilities,  and  general  descriptions  of  the  various  incident  management 
practitioners  or  actors  necessary  for  effective  comprehensive  incident  management. 
Exploring  and  delineating  key  aspects  amongst  these  various  actors  is  key  in 
understanding  how  someone  fits  in  to  the  sometimes  complex  and  dynamic  incident 
management  universe  and  structure.  It  also  helps  to  establish  a  metric  and  expectation  for 
success  and  performance.  It  would  be  foolhardy  and  inappropriate,  as  well  as  unfair  to 
expect  any  one  actor  or  practitioner  to  try  and  fulfill  all  or  even  several  of  the  various 
incident  management  roles  during  a  large  complex  incident.  Furthermore,  without  clearly 
defined  expectations,  it  can  be  very  difficult  to  determine  how  successful  someone  is.  It 
also  helps  to  ensure  that  unnecessarily  redundant,  conflicting,  and  overlapping  activities 
are  not  occurring,  or  being  expected  by  outside  stakeholders.  It  also  helps  to  reduce 
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mission-creep  amongst  the  various  disciplines  and  practitioners  within  the  incident 
management  spectrum  of  actors.  This  is  not  to  say,  even  after  a  definition  has  been 
created,  that  practitioners  never  fill  more  than  one  role.  A  person  may  be  acting  as  an 
emergency  manager  one  day  and  as  a  crisis  manager  the  next  depending  on  needs, 
qualifications,  and  clearly  defined  expectations.  The  following  section  discusses  all  the 
conceivably  differing  primary  incident  management  practitioner  types,  their  roles  and 
responsibilities,  and  how  they  fit  in  to  the  incident  management  universe. 

The  following  definitions  are  proposed. 

1.  Emergency  Responder 

An  emergency  may  be  any  individuals  who,  in  their  regular  course  and  scope  of 
duties,  may  be  dispatched  to  the  scene  of  an  incident  to  address  imminent  life  safety 
issues. 

Justification:  This  definition  is  particularly  difficult,  as  the  term  “responder”  is 
often  solely  associated  with  sworn  and  badged  public  safety  personnel.  This  proposed 
definition  addresses  life  safety  specifically  because  if  it  were  to  incorporate  life,  property, 
environment,  and  the  economy  then,  taken  literally,  any  plumber  responding  to  a  call  for 
service  for  a  residential  water  leak,  which  is  a  small  incident  in  its  own  right,  would  be 
considered  an  emergency  responder.  That  definition  would  be  too  broad  and  unsatisfying. 
However,  the  proposed  definition  would  include  anyone,  sworn  or  unsworn,  badged  or 
non-badged,  dispatched  to  the  scene  of  an  incident  to  address  immediate  life  safety 
issues. 


2.  Crisis  Responder 

Crisis  responders  may  be  any  individuals  who,  in  their  regular  course  and  scope 
of  duties,  may  be  dispatched  to  the  field  prior  to  an  impending  or  imminent  incident  to 
ensure  life  safety  or  prevent,  protect,  or  mitigate  property,  environment,  or  economic 
issues. 

Justification:  This  definition  is  perhaps  the  least  explored  “responder”  one  due  to 
the  nebulous  and  broad  use  of  the  term  “crisis”  in  the  extent  incident  management 
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literature.  The  proposed  definition  encompasses  all  personnel  dispatched  in  the  field  to 
address  issues  that  may  arise  due  to  a  known  impending  event  or  threat.  (See  also  the 
definition  of  “crisis”  in  the  “event  types”  section  of  this  proposed  lexicon)  Examples 
would  be  law  enforcement  officers  dispatched  to  the  scene  of  a  potential  crime  to  prevent 
people  with  malicious  intent  from  executing  their  plans,  or  to  protect  a  known  or 
suspected  target  from  being  exposed.  It  also  applies  to  utility  workers  shutting  off, 
hardening,  or  protecting  infrastructure  prior  to  an  impending  storm  or  other  known  event 
that  poses  a  threat  to  life,  property,  environment,  or  economy.  It  also  may  apply  to 
anyone  prepositioning  assets  or  supplies  prior  to  a  known  impending  event. 

3.  Incident  Responder 

Incident  responders  may  be  any  individuals  who,  in  their  regular  course  and  scope 
of  duties,  may  be  dispatched  to  the  scene  of  an  incident  to  address  potential  life  safety 
issues,  or  prevent,  protect,  or  mitigate  life  safety,  property,  environment,  or  economic 
issues. 

Justification:  This  definition  encompasses  everyone  in  the  incident  management 
spectrum  dispatched  to  the  field.  It  includes  sworn  and  unsworn,  badged  and  non-badged, 
and  all  other  response  personnel  in  the  field.  Incident  response  is  the  umbrella  that 

captures  both  emergency,  crisis,  and  support  personnel  in  the  field  in  response  to  an 

incident  that  has  occurred. 

4.  Incident  Commander 

An  incident  commander  is  the  person  responsible  for  all  aspects  of  incident 
response  at  the  scene  of  an  incident,  which  includes  the  development  of  incident 
objectives,  the  management  of  incident  operations,  the  application  of  resources,  and  the 
responsibility  for  the  safety  and  actions  of  all  persons  involved. 

Justification:  The  key  to  this  definition  is  “at  the  scene.”  If  an  individual  is  not  at 
the  incident  command  post  and  not  directing  the  responders  on  the  scene  then  that  person 
is  not  the  incident  commander.  Being  on  the  scene  is  inherent  to  the  incident  commander 
as  that  individual  is  responsible  for  the  safety  and  actions  of  those  in  the  field,  which 
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cannot  be  adequately  accomplished  from  a  remote  location.  (Exceptions  may  be 
considered  when  the  application  of  technology  allowing  personnel  to  direct  real-time 
tactical  field  response  from  a  distance  is  utilized.  More  research  should  be  done  on  this 
topic.)  Additionally,  it  should  be  noted  that  an  incident  commander’s  control  mechanism 
is  “command,”  primarily  due  to  the  life  safety  and  tactical  responsibilities  inherent  to  the 
position. 

5.  Incident  Manager 

Incident  managers  are  any  individual  who,  in  their  regular  course  and  scope  of 
duties,  are  responsible  for  managing  an  incident  through  command  activities,  dispatch 
activities,  or  support  activities.  They  are  also  responsible  during  all  three  phases  of  the 
incident  management  process. 

Justification:  The  incident  management  universe  is  composed  of  practitioners  in 
various  disciplines  who  all  have  some  pivotal  role  in  incident  management;  some  during 
all  types  of  incidents,  and  others  during  specific  types  of  incidents.  However,  simply 
participating  in  one  phase  of  the  incident  management  process  (preparedness,  incident 
response,  and  consequence  management)  does  not  make  a  practitioner  an  incident 
manager.  For  example,  just  because  a  practitioner  teaches  preparedness  courses  to  local 
CERT  teams,  or  does  technical  analyst  or  consulting  work  on  a  mitigation  plan,  or  runs  a 
local  assistance  center  during  the  consequence  management  phase,  does  not  mean  that 
said  practitioner  is  an  incident  manager.  However,  those  functional  or  subject  matter 
experts  do  have  key  roles  and  should  not  be  discounted. 

6.  Crisis  Manager 

Crisis  managers  are  any  people  who,  in  their  regular  course  and  scope  of  duties, 

are  responsible  for  managing  a  specific  incident  response  or  incident  support  department, 

function,  or  discipline,  who  have  direct  authority  and  operational  control  or  direction  over 

incident  response  or  support  assets  or  personnel  that  address  imminent  life  safety  issues, 

or  prevent,  protect,  or  mitigate  property,  environment,  or  economic  issues,  whose  actions 

may  include  quickly  developing  functional,  organizational  objectives,  managing  all 

dispatch  and  functional  operations  outside  of  the  incident  scene,  the  prioritization  of 
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resources  to  various  incidents  or  threats,  as  well  as  being  responsible  for  the  posturing  of 
assets  and  of  all  persons  in  that  function  or  discipline  outside  of  the  scene  and  not 
otherwise  under  the  incident  commander’s  purview.  These  peoples’  control  mechanism  is 
directive  in  nature  since  they  have  the  organizational  and  positional  authority  to  direct 
agency  and  organizational  resources,  but  the  tactical  and  life  safety  issues  do  not  require 
a  command  style  control  mechanism;  it  is  asset  posture  oriented. 

Justification:  Assets  have  to  get  to  the  scene  before  the  incident  commander 
takes  authority  over  them.  Also,  assets  must  be  brokered  amongst  various  incidents. 
Additionally,  if  an  incident  has  not  yet  occurred,  but  a  known  future  incident,  preventable 
incident,  potentially  imminent  incident,  or  threat  is  present,  someone  has  to  manage  the 
objectives,  resources,  and  tactics  for  the  various  functions  or  disciplines  involved  in  the 
response  to  these  potential  crises  (See  also  the  definition  of  “crisis”  in  the  “event  types” 
section  of  this  proposed  lexicon).  Lastly,  support  resources  must  be  mobilized  to  manage 
activities  outside  of  the  scene.  These  activities  are  examples  for  which  crisis  managers 
are  responsible.  These  examples  of  crisis  managers  might  include  people  working  in 
DOCs  managing  the  deployment  of  additional  ambulances  or  fire  engines  to  the  incident, 
shelter  managers  to  various  shelters,  heavy  equipment  to  debris  basins  prior  to  a  large 
storm,  law  enforcement  officers  to  potential  additional  targets  after  a  terrorist  attack,  or 
vaccination  supplies  in  preparation  for  a  spreading  pandemic.  Crisis  managers  may  also 
work  in  dispatch  centers,  emergency  operations  centers,  or  area  command  posts. 

7.  Crisis  Leader 

A  crisis  leader  is  any  senior  executive  or  elected  official  responsible  for  to 
providing  organizational  leadership  through  representation,  messaging,  advocacy 
mobilization,  fund  raising,  law  creation,  or  other  similar  role  internal  or  external  to  the 
organization  during  times  of  incidents  or  larger  events,  where  those  actions  mitigate 
potential  or  imminent  negative  ramifications  on  the  organization,  the  organization’s 
reputation,  or  the  organization’s  incident  management  efforts  caused  by  unmitigated 
negative  stakeholder  sentiment  or  perception. 
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Justification:  During  disasters,  it  is  common  to  have  the  organization  come  under 
significant  public  or  stakeholder  scrutiny.  That  scrutiny,  unchallenged,  addressed,  or 
answered  may  cause  long-term  harm  to  the  credibility  of  the  larger  organization.  It  may 
also  create  unnecessary  friction  or  difficulty  for  the  various  incident  management 
practitioners  involved  (for  example,  angry  citizens  rioting  and  harming  emergency 
responders,  where  strong  crisis  leadership  might  have  limited,  reduced,  or  eliminated  the 
number  of  rioters).  Strong  effective  crisis  leadership  can  only  serve  to  support  and 
improve  the  efficacy  of  the  entire  incident  management  structure,  and  is  thusly,  a  key 
component  of  effective  incident  management.  They  are  given  the  term  “crisis”  in  the  title 
because  they  are  mitigating  additional  incidents  or  impacts  to  the  organization  that  have 
yet  to  occur.  Furthermore,  an  incident  may  not  necessarily  threaten  the  parent 
organization,  but  the  stakeholder  sentiment  may  specifically  threaten  the  organization  at 
large,  and  crisis  leadership  is  specifically  addressing  that  threat;  thus,  the  term  “crisis.”  It 
should  be  noted  that  a  crisis  leader’s  control  mechanism  is  primarily  policy  setting  and 
political  in  nature.  Crisis  leaders  are  often  senior  level  executives  and  elected  officials. 

8.  Emergency  Manager 

Emergency  managers  are  individuals  with  expertise  in  the  implementation  of  the 
necessary  communication  and  operational  framework  necessary  for  effective  strategic 
collaboration  of  senior  level  subject  matter  experts  who  represent  various  incident 
management  functions  or  disciplines  during  all  phases  of  incident  management  towards 
the  goal  of  successful  disaster  support  coordination. 

Justification:  During  the  incident  response  phase,  the  actions  and  activities  that 
take  place  at  the  scene  of  the  incident  are  classified  as  tactical  incident  command.  The 
actions  that  occur  in  functional  DOCs  are  classified  as  operational  crisis  management. 
The  actions  that  take  place  at  the  Emergency  Management  Center  (EMC)  are  classified  as 
strategic  disaster  support  coordination.  Those  with  multi-discipline  collaboration 
responsibility  at  the  scene  of  the  incident  are  considered  incident  commanders  and  are 
part  of  the  incident  command  system.  Crisis  managers  in  DOCs  direct  the  operational 
support  to  the  incident  of  single  or  related  functions  or  disciplines.  EMCs  are  the  location 
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where  high-level  officials  and  subject  matter  experts  from  a  vast  array  of  functions 
collaborate  strategically,  and  are  the  mechanism  by  which  emergency  managers  facilitate 
successful  disaster  support  coordination.  During  the  consequence  management  phase, 
emergency  managers  are  responsible  for  facilitating  the  collaboration  between  the  various 
high-level  officials  and  subject  matter  experts  representing  the  various  recovery 
functions,  while  crisis  managers  and  incident  commanders  are  more  focused  on 
demobilization  and  deactivation.  During  the  preparedness  phase,  incident  command 
practitioners  focus  on  increasing  their  functional  response  capability,  crisis  managers 
focus  on  their  function-specific  operational  preparedness  and  capacity,  and  emergency 
managers  focus  on  collaborative  multi-function  or  discipline  planning  and  preparedness. 
Incident  command  practitioners  focus  on  function  specific  competencies,  crisis 
management  practitioners  focus  on  function  specific  and  coordination  (within  their 
function)  and  analysis  competencies,  and  emergency  managers  focus  not  on  function  or 
discipline  specific  knowledge,  skills,  and  abilities,  but  instead  on  coordination  skills,  and 
the  KSAs  specifically  associated  with  the  collaborative  incident  management  disaster 
support  coordination  communication  and  operations  frameworks.  An  emergency 
manager’s  control  mechanism  is  coordination  since  emergency  managers  are  not  often 
granted  authority  over  the  staff  and  resources  in  the  EMC.  They  control  through  positive 
coercion. 


9.  Emergency  Management  Functional  Representative 

Emergency  management  functional  representatives  are  individuals  possessing 
senior  level  expertise  and  authority  in  a  single  incident  management  function  or 
discipline  assigned  to  the  EMC  to  represent  their  discipline,  function,  and  department  in 
collaborative  strategic  coordination  and  support  activities. 

Justification:  An  EMC  is  only  as  successful  as  the  practitioners  who  represent 
the  various  functions  needed  to  be  collaboratively  coordinated.  Just  as  a  conductor  and  no 
musicians  would  make  a  poor  orchestra,  an  emergency  manager  with  no  emergency 
management  functional  representatives  would  make  a  poor  EMC.  Emergency  managers 
simply  apply  a  collaboration,  communication,  and  coordination  framework  to  the  various 
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disparate  functions  and  disciplines  represented  in  an  EMC.  Emergency  management 
functional  representatives  can  best  be  described  as  the  gears  in  the  EMC  machine,  where 
emergency  managers  are  the  grease  in  the  gears  that  allows  them  to  function  smoothly 
without  friction. 

10.  Risk  Manager 

A  risk  manager  is  an  individual  within  a  single  discipline  or  function  or  larger 
conglomerate  organization  who,  during  the  preparedness  phase  of  incident  management, 
determines  the  acceptable  level  of  risk  based  on  the  gap  between  preparedness  and 
vulnerabilities,  as  determined  by  hazard,  threat,  and  capability  assessments. 

Justification:  If  an  organization  is  large  enough,  or  rich  enough  in  resources,  it 
might  have  specifically  designated  risk  managers  whose  sole  responsibility  is  to 
determine  an  acceptable  level  of  risk,  and  make  adjustments  or  recommend  adjustments 
accordingly.  These  practitioners  probably  should  not  be  considered  incident  management 
practitioners,  as  their  responsibilities  are  limited  to  the  preparedness  phase  of  incident 
management. 

11.  Disaster  Coordinator 

A  disaster  coordinator  is  an  individual  who  organizes  disparate  organizations  into 
disaster  support  functions  or  disaster  support  services  (i.e.,  spontaneous  volunteer  center 
coordinators,  family  assistance  center  coordinators,  community  emergency  response  team 
dispatch  center,  etc.) 

Justification:  Those  with  organizational  skills,  who  understand  the  foundational 
incident  management  components,  and  have  a  working  relationship  with  community 
members  and  community  organizations,  are  often  pivotal  during  major  disasters  as  a 
mobilizing  force  and  magnet  for  the  community’s  varying  invaluable  resources. 

12.  Emergency  Planner:  (Profession/Discipline  Sub-classification) 

An  emergency  planner  is  an  individual  within  any  incident  management 
profession  or  discipline  responsible  for  facilitating,  creating,  and  reviewing  incident 
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management  related  plans,  policies,  annexes,  etc.  prior  to  an  incident  or  event,  and  who 
during  an  event,  assists  in  the  creation  of  action  plans.  These  planners  may  assist  in  or 
facilitate  consequence  management  recovery  planning  depending  on  their  respective 
profession  or  discipline. 

Justification:  Incident  management  or  emergency  response  plans  often  cover  the 
collaborative  or  disparate  roles,  responsibilities,  and  actions  of  various  incident 
management  professions,  disciplines,  and  stakeholders  and  require  the  contribution, 
input,  insight,  and  expertise  of  experienced  craftsmen  practitioners  who  also  understand 
foundational  planning  processes  (ideally  as  outlined  in  FEMA’ s  Comprehensive  Planning 
Guidance  CPG-101).  Additionally,  during  the  incident  response  phase,  incident  managers 
at  all  levels  often  participate  in  the  action  planning  process  to  establish  operational  period 
incident  management  objectives  and  operational  tempo.  During  the  consequence 
management  phase,  recovery  plans  are  often  needed,  and  experienced  planners  can  help 
shape  and  facilitate  those  plans  by  organizing  organizations  and  disciplines  for  those  who 
may  not  often  participate  in  emergency  planning  or  incident  management  planning. 

13.  Preparedness  Specialist 

A  preparedness  specialist  is  any  person  responsible  for  promoting,  teaching,  or 
ensuring  individual  disaster  preparedness  and  resilience.  This  person  generally  has  no 
incident  response  or  recovery  responsibilities. 

Justification:  Preparedness  specialists  generally  have  no  operational  authority  or 
responsibility  during  an  incident.  If  a  preparedness  specialist  has  been  successful,  then 
individuals  will  be  better  positioned  to  withstand  the  adverse  effects  of  an  incident, 
whether  those  effects  are  financial,  physical,  emotional,  organizational,  etc. 

14.  Business  Continuity  Specialist 

A  business  continuity  specialist  is  any  individual  with  expertise  in  ensuring 
sustainability  and  minimal-to-no  disruption  of  service  delivery,  product  development,  or 
mission  continuation  broadly  or  specifically  related  to  a  business  sector,  profession, 
discipline,  or  department. 
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Justification:  When  the  operating  environment  conditions  (temporarily  or 
permanently)  adversely  change  for  a  business  (or  organization)  making  it  difficult  to  meet 
operational  obligations  or  expectations,  an  organization  must  be  able  to  be  flexible  or 
resilient  enough  to  weather  the  new  conditions  long  enough  to  either  allow  the  conditions 
to  return  to  normal  or  the  business  or  organization  to  adapt  their  business  and  service 
model  to  thrive  within  the  new  operating  environment.  Business  continuity  specialists 
focus  on  ensuring  organizations  are  best  positioned  and  prepared  to  withstand  changing 
operating  environments  and  are  the  equivalent  of  preparedness  specialists  for 
organizations  as  opposed  to  individuals. 

C.  ORGANIZATIONS 

As  presented  in  Figures  7  and  8,  the  organizations  discussed  are  emergency 
operations  centers,  department  operations  center,  dispatch  centers,  command  posts,  and 
on-scene. 


IM  Guiding  IM  Mission  Control  Primary 

Practitioners  Doctrine  Levels  Focus  Method  Activities 


Politicians 


Executives 


Emergency 

Managers 

Crisis 

Managers 


Incident 

Responders 


Law/Code/ 

Ordinances 

Departmental 

Policies 


NIMS/EOP 


Departmental 

Procedures 


ICS 


Political 


Policy 


Strategic 


Operational 


Tactical 


Leadership 


Advisory 


Coordination 


Direction 


Command 


Financing/Public 

Support/Laws 

Codifying 
Strategic  Methods 

Continuity  of 
Govt.  &  Strategic 
Coordination 

Moving  Resources 
Around 

Resources 
Fighting  the  Fight 


This  figure  is  a  conceptual  diagram  of  the  various  incident  management  levels,  the 
practitioners  at  each  of  those  levels,  the  mission  focuses  of  each  incident  management 
level,  and  other  key  incident  management  level  characteristics.  This  figure  applies  to  the 
entire  organizations  section,  but  is  also  used  in  other  sections. 


Figure  7.  Incident  Management  Levels. 
59 


These  figures  are  conceptual  diagrams  of  the  various  incident  management  modular 
components  that  might  be  utilized  during  a  large  complex  event.  These  figures  apply  to 
the  entire  organizations  section.  Notice  specifically  the  universal  common  applicability  of 
the  model  to  all  levels  of  government,  and  the  potential  for  all  those  organizational 
components  to  activate  a  supplemental  Multi-Agency  Coordination  Group  (MACG) 
should  the  need  arise. 

Figure  8.  Potential  Incident  Management  Layers  and  Incident  Management 

Layers  and  MACGs. 

Introduction:  Within  the  extent  incident  management  literature,  as  demonstrated 
within  the  literature  review,  several  areas  of  activity,  organizational  structures,  and 
command  and  control  organizations  are  described.  Within  the  literature,  some  of  these 
organizations  receive  more  attention  and  greater  definition,  description,  and  clarity  than 
others.  For  some,  the  roles  and  responsibilities  are  somewhat  vague  or  ill-defined;  for 
others,  their  purpose  seems  to  be  redundant,  and  others  are  described  within  limited 
context.  Understanding  what  organizations  are  carrying  out  which  incident  management 
activities  helps  to  understand  how  the  entirety  of  the  incident  management  universe,  what 
organizational  components  are  necessary  for  effective  incident  management,  what 
activities  are  carried  out  by  which  practitioners  and  at  what  level,  and  appropriate  areas 
of  focus  depending  on  an  area  of  operation.  It  would  be  difficult  and  potentially 
disastrous  to  expect  the  same  incident  management  organization  to  manage  the  tactics, 
operations,  strategies,  policies,  and  politics  of  various  simultaneous  dynamic  incidents, 
crises,  emergencies,  disasters,  or  catastrophes.  A  division  of  labor  and  a  division  of  focus, 
responsibility,  and  expectation  should  be  delineated  amongst  the  various  incident 
management  organizations. 
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The  following  definitions  are  proposed. 


1.  Emergency  Management  Center 

Emergency  management  takes  place  at  an  EMC.  It  is  a  multi-function 
coordination  center  where  representatives  from  various  disciplines  and  functions 
strategically  coordinate  using  a  common  language,  planning  method,  and  organizational 
structure  applied  by  emergency  managers.  The  EMC  supports  the  DOCs  and  the  incident 
command  post  (ICP)  and  ensures  continuity  and  survivability  of  its  parent  organization. 
EMCs  have  very  little  if  no  direct  command  and  control  over  field  assets. 

Justification:  Currently,  traditionally  known  as  EOCs,  EMCs  are  the  hub  of  an 
organization’s  cross-functional  multi -discipline  strategic  coordination  in  preparation  for 
and  response  to  large  dynamic  incidents  and  events  with  a  focus  on  response,  recovery, 
and  organizational  continuity  of  service.  If  an  EMC  is  activated  prior  to  a  known 
impending  incident  or  event  (i.e.,  hurricane  or  large  planned  event)  then  the  EMC’s  focus 
is  on  crisis  management  support  and  situational  awareness.  It  should  be  noted  that  when 
engaged  in  crisis  management  support  activities,  an  EMC’s  focus  is  not  on  protection  or 
prevention;  it  is  focused  on  damage  mitigation,  preparedness,  situational  awareness, 
strategic  policy  evaluation,  and  business  continuity.  EMCs  do  not  prevent  hurricanes, 
tornadoes,  earthquakes,  terrorists,  cyber  attacks,  etc.  Operational  DOCs  from  specific 
functions  or  departments  with  control  over  response  assets  (law  enforcement,  fire,  public 
health,  etc.)  are  responsible  for  the  execution  of  prevention  and  protection  activities.  Prior 
to  an  incident  or  event  during  the  crisis  management  activities,  EMCs  focus  on  reducing 
and  mitigating  the  potential  damage  from  impending  or  imminent  threats  and  incidents, 
and  implementing  measures  that  might  expedite  the  recovery  process.  The  name  EMC  is 
more  appropriate  than  EOC  because  EMCs  do  not  actually  direct  field  operations  or  have 
control  over  field  assets,  so  the  term  “operations”  makes  little  sense  and  only  serves  to 
create  potential  confusion  about  roles  and  responsibilities  and  may  potentially  create 
mission  creep. 


61 


2. 


Department  Operations  Center 


Operational  crisis  management  occurs  at  a  DOC.  It  is  a  single  department, 
discipline,  or  function’s  operations  center  where  crisis  managers  and  technicians 
operationally  manage,  deploy,  or  dispatch  assets,  resources,  or  personnel  to  incidents  and 
other  field  locations  to  support  tactical  activities.  DOCs  are  the  primary  conduit  between 
EMC  strategy  and  coordination  and  field  tactical  activities. 

Justification:  Those  with  operational  knowledge  and  expertise  within  a  specific 
function  (law,  fire,  public  health,  public  works,  etc.)  who  are  empowered  to  make 
decisions  about  operational  prioritization  of  department  or  function  assets  in  relation  to 
various  incidents  work  out  of  operations  centers  that  serve  as  the  hub  for  incoming  field 
intelligence,  information,  communications,  and  dispatch  of  additional  assets.  From  the 
department  operations  center,  the  strategies  developed  at  the  EMC  are  implemented  or 
executed,  and  intelligence  or  requests  from  the  field  are  vetted,  verified,  and  distilled  and 
then  shared  with  the  EMC  for  strategy  development  and  collaborative  situational 
awareness.  The  operational  control  of  function  specific  assets  may  serve  in  a  prevention, 
protection,  mitigation,  preparedness,  response,  or  recovery  role.  Department  operations 
centers  may  activate  prior  to  or  without  an  EMC  activation  for  function  specific  incidents 
or  for  function  specific  threats  to  posture  assets  and  prioritize  threats  and  intelligence  as 
necessary. 


3.  Multi-Agency  Coordination  Group 

A  MACG  is  a  supplemental  incident  management  issue  or  problem  set  driven 
component  composed  of  relevant  technical  specialists  from  appropriate  agencies  or 
functions  activated  by  and  beholden  to  any  organization  layer  of  the  incident 
management  structure  to  address  a  complex  issue  that  might  otherwise  consume,  slow 
down,  or  hinder  the  parent  incident  management  organization’s  operational  tempo  or 
processes. 

Justification:  The  multi-agency  coordination  system  (MACS)  is  one  of  the  more 
difficult  issues  to  address  or  discern  among  existing  incident  management  components. 
As  demonstrated  in  the  literature  review  and  analysis  portion  of  this  study,  the  extent 
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literature  does  not  often  clearly  delineate  between  the  roles  and  responsibilities  of  the 
MACS  and  other  incident  management  component  organizations,  such  as  EOCs.  If  it  can 
be  agreed  upon  that  the  other  identified  organizations  make  up  a  comprehensive  incident 
management  structure,  then  it  is  perhaps  best  to  view  the  multi-agency  coordination 
concept  as  a  supplemental  concept  best  utilized  to  enhance  or  supplement  existing 
structures.  With  this  understanding  in  mind,  it  makes  sense  then  to  consider  a  group  of 
specialists  (from  potentially  varying  and  disparate  organizations,  agencies,  disciplines, 
etc.)  assigned  to  solve  a  particular  problem  set  a  MACG  activated  and  assigned  to  a 
parent  incident  management  organization,  such  as  an  EMC  or  DOC.  The  effective 
operations  or  activities  of  an  ICP,  DOC,  or  EMC  depend  upon  an  established  tempo  and 
planning  cycle.  Often,  a  difficult  problem  (such  as  resource  scarcity  or  incident 
prioritization)  can  slow  down  the  tempo  or  hinder  the  larger  objective  setting  cycle  of  an 
EMC  or  DOC.  Thus,  it  is  best  recommended  to  create  a  MACG  to  address  that  issue 
specifically  outside  of  the  general  activities  and  tempo  of  that  organization  so  that  general 
progress  can  continue  to  be  made. 

4.  Incident  Command  Post 

The  ICP  is  the  location  on  scene  from  which  all  on-scene  command,  control, 
incident  planning,  and  tactical  operations  are  directed  by  the  incident  commander  through 
the  chain  of  command  as  outlined  in  the  incident  command  system  (ICS). 

Justification:  The  ICP  is  a  foundational  element  of  the  ICS.  It  ensures  that  the 
span  of  control,  responsibility,  resource  allocation,  planning  by  objectives,  and  on-scene 
safety  are  all  accomplished. 

5.  Incident  Management  Team 

An  incident  management  team  (IMT)  is  a  team  deployed  to  support  and  consult 
for  the  full  spectrum  of  incident  management  needs  from  preparedness,  to  incident 
response,  to  consequence  management.  An  IMT  may  also  be  deployed  as  the  primary 
response  agency  to  an  event  of  national  significance  in  a  non-domestic  territory  or 
location. 
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Justification:  IMTs  rarely  supplant,  replace,  or  override  local  incident  command. 
They  are  not  given  the  authority  to  do  so  unless  a  delegation  of  authority  is  authorized  by 
the  local  organization  (in  home  rule  states).  IMTs  are  generally  deployed  to  assist  local 
governments  and  local  emergency  response  agencies  with  the  management  aspects  of 
large,  complex,  or  dynamic  incidents,  or  multiple  incidents.  In  non-domestic  non-Stafford 
Act  incidents  where  local  government  does  not  necessarily  have  jurisdictional  authority, 
IMTs  may  be  deployed  as  the  primary  response  agency. 

6.  Incident  Command  Support  Team 

An  incident  command  support  team  (ICST)  is  a  team  of  trained  incident  command 
experts  deployed  to  support  and  consult  for  incident  commanders  of  dynamic  incidents 
where  additional  support  and  expertise  is  necessary. 

Justification:  ICST  is  the  proposed  term  and  definition  for  teams  deployed  to 
support  field  level  response  agencies  solely,  and  not  an  EOC  or  emergency  management 
function.  Currently,  IMT  is  the  term  used  to  signify  support  for  both  field  and  support 
level  operations  and  delineation  is  rarely  made  between  qualification,  capability,  or 
purpose.  This  term  will  more  clearly  define  what  the  deployed  or  inbound  support  team’s 
purpose  is,  and  what  their  qualifications  and  capabilities  are. 

7.  Emergency  Management  Assistance  Team 

An  emergency  management  assistance  team  (EMAT)  is  a  team  of  trained 
emergency  management,  continuity  of  government  or  business  continuity,  and 
consequence  management  experts  deployed  to  support  and  consult  for  EOC  and  recovery 
operations. 

Justification:  It  is  the  proposed  term  and  definition  for  teams  deployed  to  support 
EOC  operations  solely,  and  not  field  level  operations.  Often,  when  IMTs  are  deployed  to 
incidents,  they  have  an  ICS  and  field-centric  focus,  and  inappropriately  apply  tactical 
strategies  to  support  and  coordination  EOC  operations.  Knowing  whether  the  deployed 
team  is  qualified  and  credentialed  for  EOC  support  and  coordination  operations,  as 
opposed  to  field  level  ICS  operations,  is  key  to  legitimacy  and  appropriateness  in  an  EOC 
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setting.  As  emergency  management  becomes  more  defined  as  a  discipline,  and  as 
credentials  and  qualifications  for  support  and  coordination  operations  within  an  EOC 
become  more  defined,  it  will  become  more  necessary  to  delineate  between  tactical  field 
versus  support  and  coordination  competencies,  capabilities,  and  qualifications. 

D.  PHASES 

As  presented  in  Figure  9,  the  phases  discussed  are  preparedness,  incident 
response,  and  consequence  management. 


This  figure  is  a  conceptual  diagram  of  the  process  of  incident  management  over  time,  and 
the  components  therein.  It  applies  to  the  entire  phases  section  (similar  graphs  apply  to  the 
sense  making  characteristics  and  activities  sections).  Notice  specifically  the  highlighting 
of  the  phases  section,  and  the  three  identified  phases  of  the  incident  management  process. 
It  should  be  noted  that  the  size  of  each  of  these  phases  is  conceptual  and  are  not  static 
from  one  incident  to  the  next.  They  may  be  larger  or  smaller  in  relation  to  each  other,  but 
were  depicted  in  this  figure  as  equal  for  graphical  purposes. 

Figure  9.  Understanding  the  Process  of  Incident  Management  (Phases). 
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Introduction:  The  extent  literature  and  doctrine  describe  throughout  as  few  as 
two  phases  of  emergency  management  and  as  many  as  seven.  Furthermore,  some  denote 
them  as  phases  of  emergency  management,  others  as  phases  of  incident  management,  and 
still  others  as  mission  areas  or  planning  areas.  It  can  get  confusing.  If  the  term  phases  of 
emergency  management  is  used,  it  may  cause  people  to  believe  that  everything  done  in 
those  phases  should  be  done  by  emergency  managers.  Or,  if  the  terms  missions  or 
planning  areas  are  used,  then  the  context  or  time  and  phases  is  lost  (as  recent  federal 
doctrine  often  leaves  out  the  concept  of  phases).  It  is  perhaps  beneficial  then  to 
understand  and  have  the  context  of  the  entire  process  of  what  incident  management  is 
being  called,  to  include  the  sequence  of  events  and  inherent  actions  and  activities,  as  well 
as  who  is  involved  in  each. 

The  following  definitions  are  proposed. 

1.  Preparedness 

Preparedness  is  referred  to  the  period  prior  to  an  incident  or  imminent  threat 
during  which  the  combination  of  the  separate  component  activities  of  prevention, 
protection,  hazard  mitigation,  risk  management,  training,  and  planning  occur. 

Justification:  The  sum  of  the  activities  of  prevention,  protection,  hazard 
mitigation,  risk  management,  training,  and  planning  is  the  measure  of  achievement  of  the 
goal  and  ideal  state  of  being  prepared.  A  low  sum  equals  greater  vulnerability  and  lower 
preparedness.  It  should  be  noted  that  the  goal  of  being  completely  prepared  will  always 
remain  unattainable  and  illusive,  as  unknown  vulnerabilities  will  always  be  present  due  to 
inherent  uncertainty  and  limited  predictive  capabilities.  The  consistent  known 
vulnerabilities  and  threats  inherent  to  the  operating  environment  should  inform  and  focus 
the  various  component  activities  during  the  preparedness  phase.  Once  a  known  active  or 
imminent  threat  presents  itself,  passive  preparedness  activities  transition  into  active  crisis 
management  or  incident  response  activities. 
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2.  Incident  Response 

An  incident  response  is  the  period  after  a  known  incident  (see  previous  definition 
for  incident)  has  occurred  or  once  an  active  imminent  threat  becomes  known  and 
emergency  responders  seek  to  know  the  unknown  and  act  to  reduce  or  eliminate  the 
immediate  threats  to  life  safety,  environmental  or  property  damage,  or  economic  loss,  and 
ensure  scene  security  and  safety. 

Justification:  Whether  it  is  a  car  accident,  an  earthquake,  an  explosion,  active 
shooter,  cyber-attack,  or  other  type  of  incident,  emergency  responders  from  various 
incident  management  disciplines  will  perform  one  of  the  incident  command,  crisis 
management,  or  disaster  support  coordination  activities  depending  on  the  size  or 
complexity  of  the  incident.  Regardless  of  the  size  of  the  incident,  actions  must  be  taken  at 
some  level  to  ensure  the  scene  is  secure  and  no  continued  or  additional  threats  exist, 
which  requires  an  action  of  volition  known  as  incident  response.  It  should  be  noted  that 
until  scene  safety  and  security  are  established,  the  incident  response  could  best  be 
described  as  chaotic.  Safety  and  security  may  be  established  early  or  after  a  seemingly 
long  period  of  time. 

3.  Consequence  Management 

The  period  during  which  actions  are  taken  to  return  to  or  establish  a  new  normal 
state  and  direct  remediation  efforts  are  undertaken  is  known  as  consequence 
management. 

Justification:  Consequence  management  is  begun  once  the  scene  of  an  incident 
(or  parts  of  the  scene)  or  the  threat  environment  are  determined  by  incident  command  or 
crisis  management  personnel  to  be  safe  or  secure  enough  to  begin  recovery  operations 
(debris  removal,  repopulation,  repatriation,  rebuilding,  environmental  remediation,  cyber 
improvement  activity/repair,  etc.). 

E.  SENSE  MAKING  CHARACTERISTICS  (CYNEFIN  FRAMEWORK) 

As  presented  in  Figure  10,  the  characteristics  discussed  are  simple/obvious, 
complicated,  complex,  chaotic,  and  disorder. 
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This  figure  is  a  conceptual  diagram  of  the  process  of  incident  management  over  time,  and 
the  components  therein.  This  figure  applies  to  the  entire  sense  making  characteristics 
(Cynefin  Framework)  section  (similar  graphs  apply  to  the  prior  phases  and  following 
activities  sections).  Notice  specifically  the  highlighting  of  the  Cynefin  Framework 
section,  and  the  inherent  sense  making  characteristics  of  each  phase  of  incident 
management,  and  its  cyclical  nature. 

Figure  10.  Understanding  the  Process  of  Incident  Management  (Cynefin 

Framework). 

Introduction:  The  Cynefin  Framework  is  a  sense-making  and  problem-solving 
framework  that  helps  define  the  characteristics  of  understanding  in  the  transition  between 
and  classification  of  domains  between  disorder  and  chaos,  and  obvious  simplicity.  The 
Cynefin  Framework  is  a  conceptual  model  in  its  own  right,  used  to  describe  sense 
making.  As  a  sense-making  conceptual  model,  the  Cynefin  Framework  is  well-suited  for 
informing  the  chronological  sense-making  characteristics  of  this  larger  proposed  incident 
management  conceptual  model.  The  line  between  what  is  simple,  or  otherwise  obvious, 
and  what  is  chaotic,  or  seemingly  unknowable,  can  be  described  as  disastrous,  where 
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complacency  results  in  failure.  Thus,  preparedness  becomes  a  paramount  and  primary 
aspect  of  incident  management.  Regardless  of  preparedness,  or  how  prepared  a  person, 
group,  organization,  or  agency  is  however,  the  moment  an  incident  occurs,  it  must  be 
made  sense  of,  recognized,  and  processed.  This  process  may  take  place  in  a  relatively 
short  or  protracted  amount  of  time  depending  on  several  factors  (preparedness, 
complexity  or  dynamism  of  incident,  familiarity  or  experience,  etc.).  Understanding  the 
sense-making  process  helps  to  define  what  activities  are  occurring,  what  activities  should 
be  occurring,  who  the  relevant  participants  are  or  should  be,  and  provides  a  better 
understanding  of  the  appropriate  next  steps  and  desired  outcomes.  Understanding  the 
sense-making  patterns  also  helps  the  incident  management  enterprise  understand  itself 
and  can  serve  to  improve  the  amount  of  time  it  takes  to  gain  an  effective  perspective  on  a 
situation.  An  incident  manager  should  understand  the  sense-making  process  of  incidents 
to  understand  themselves  and  their  role  in  the  process  better. 

The  following  definitions  are  proposed. 

1.  Simple/Obvious 

The  Cynefin  Framework  defines  simple/obvious  as  the  period  in  which  “the 
relationship  between  cause  and  effect  is  obvious  to  all”  and  the  approach  to  making 
decisions  is  to  sense,  categorize,  and  then  respond.92  This  sense-making  category  applies 
to  the  earliest  preparedness  phase  actions  and  latest  consequence  management  phase 
actions  of  incident  management. 

Justification:  The  most  basic  and  simple  preparedness  actions  should  be  either 
simple  or  obvious,  or  both.  When  beginning  to  increase  preparedness,  the  various 
activities  and  measurement  of  prevention,  protection,  hazard  mitigation,  risk 
management,  training,  and  planning  become  more  intertwined  and  interdependent,  and 
inherently  more  complicated.  Additionally,  once  incident  response  demobilization  has 
taken  place,  and  as  consequence  management  and  response  activities,  processes,  and 
roles  and  responsibilities  become  well  defined  and  categorized,  decisions  become 

92  Christopher  Bellavita,  “Shape  Patterns,  Not  Programs,”  Homeland  Security  Affairs,  vol.  II,  no.  3 
(2006):  1-21. 
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obvious  or  simple.  All  that  should  be  required  during  these  periods  is  to  determine  the 
need,  categorize  it,  and  act. 

2.  Complicated 

The  Cynefin  Framework  defines  complicated  as  the  period  in  which  “the 
relationship  between  cause  and  effect  requires  analysis  or  some  other  form  of 
investigation  and/or  the  application  of  expert  knowledge,”  and  the  approach  to  making 
decisions  is  to  sense,  analyze,  and  then  respond.93  This  sense-making  category  applies  to 
the  primary  preparedness  and  consequence  management  phases  of  incident  management. 

Justification:  Advanced  preparedness  activities  require  technical  hazard 
mitigation  analysis,  risk  management  analysis,  and  several  levels  of  preparedness 
evaluation.  The  various  activities  inherent  to  advanced  preparedness  are  tightly  woven, 
interconnected,  and  dependent.  Additionally,  during  the  first  steps  and  earliest  activities 
of  the  consequence  management  phase  of  incident  management,  significant  evaluation 
occurs  of  recovery  capabilities,  needs,  priorities,  stakeholders,  roles  and  responsibilities, 
cost  reimbursement  processes,  and  other  issues  that  have  to  be  categorized  and 
mechanized,  many  of  which  are  interdependent  and  tightly  woven. 

3.  Complex 

The  Cynefin  Framework  defines  complex  as  the  period  in  which  “the  relationship 
between  cause  and  effect  can  only  be  perceived  in  retrospect,  but  not  in  advance,”  and  the 
approach  to  making  decisions  is  to  probe,  sense,  and  then  respond.94  This  sense-making 
category  applies  to  the  pre-incident  crisis  management  and  “demobilization,”  or 
consequence  management  transition  activities  of  the  incident  response  phase  of  incident 
management. 

Justification:  When  an  active  imminent  threat  becomes  known,  actions  must  be 
taken  to  prevent  it  if  possible,  protect  targets,  mitigate  damages,  complete  just-in-time 
training,  gather  intelligence,  information,  and  situational  awareness,  deploy  or  dispatch 

93  Bellavita,  “Shape  Patterns,  Not  Programs,”  1-21. 

94  Ibid. 
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assets,  etc.  Many  of  these  activities  are  tightly  interwoven  and  may  have  to  be 
accomplished  within  a  defined  time  period  creating  a  necessity  for  prioritization, 
expediency,  and  activity  triage.  It  is  an  inherently  complex  process  that  may  have 
extremely  high  stakes.  Additionally,  during  the  transition  from  incident  response  to 
consequence,  management  incident  commanders  must  balance  the  risk  of  undiscovered 
persistent  threats  or  hazards,  reemergence  of  threats  or  hazards,  other  unknown  factors 
and  the  need  to  demobilize,  rest  or  reduce  resources,  begin  recovery  activities  and  site 
remediation  actions.  The  transition  between  incident  response  and  consequence 
management  may  not  be  linear  and  may  require  remobilizing  response  assets  to  areas  or 
environments  previously  thought  to  be  secure  and  safe.  This  process  or  transition  is 
inherently  complex,  potentially  fraught  with  risk,  and  requires  investigation  and  loosely 
defined  threshold  determinations. 

4.  Chaotic 

The  Cynefin  Framework  defines  chaotic  as  the  period  in  which  “there  is  no 
relationship  between  cause  and  effect  at  a  systems  level,”  and  the  approach  to  making 
decisions  is  to  act,  sense,  and  then  respond.95  This  sense-making  category  applies  to  the 
post-incident  and  pre-demobilization  incident  command,  crisis  management,  and  strategic 
support  coordination  activities  during  the  incident  response  phase  of  incident 
management. 

Justification:  During  the  post-incident  and  pre-demobilization  activities  of  the 
incident  response  phase  of  incident  management,  the  cause  of  the  incident  is  often  rarely 
known,  and  emergency  responders  are  forced  to  be  primarily  reactive  in  nature, 
increasing  incident  command  structures,  activating  department  operations  centers  and 
emergency  operations  centers  as  necessary  depending  on  the  perceived  or  estimated 
complexity  and  dynamism  of  the  incident.  Often  assets  are  dispatched  to  the  scene 
without  knowing  the  extent  of  the  threat  or  hazard.  In  this  sense,  emergency  responders 
and  incident  management  practitioners  from  all  disciplines  are  acting  (responding  to) 
then  sensing  and  observing  once  they  arrive  at  the  scene  or  begin  their  respective  actions, 


95  Bellavita,  “Shape  Patterns,  Not  Programs,”  1-21. 
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and  then  respond  based  on  their  limited  observations  or  knowledge.  Once  the  extent  of 
the  hazard  or  threat  is  known,  and  it  is  determined  that  sufficient  resources  or  assets  have 
been  applied  to  the  incident,  and  the  threat  begins  to  ebb,  the  incident  then  begins  to 
transition  from  chaotic  to  complex. 

5.  Disorder 

The  Cynefin  Framework  defines  disorder  as  “the  state  of  not  knowing  what  type 
of  causality  exists  and  people  revert  to  their  own  comfort  zone  in  making  decisions.”96 
This  sense-making  category  applies  specifically  to  the  events  immediately  surrounding 
the  incident  prior  to  the  arrival  or  response  of  emergency  responders  during  the  incident 
response  phase  of  incident  management. 

Justification:  When  an  incident  happens,  people  are  generally  acting  with  very 
limited  knowledge  and  their  actions  are  the  product  of  an  inherent  desire  for  self- 
preservation  and  safety.  These  actions  may  even  be  at  the  subconscious  or  involuntary 
reaction  level.  There  is  little  to  no  ability  to  apply  systems  or  mechanisms  consciously 
during  this  phase.  These  actions  might  often  be  referred  to  as  “fight  or  flight”  actions. 

F.  ACTIVITIES 

As  presented  in  Figure  11,  the  activities  discussed  are  incident  management, 
incident  command,  crisis  management,  emergency  management,  risk  management, 
recovery,  prevention,  protection,  hazard  mitigation,  planning,  and  training. 


96  Bellavita,  “Shape  Patterns,  Not  Programs,”  1-21. 
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This  figure  is  a  conceptual  diagram  of  the  process  of  incident  management  over  time,  and 
the  components  therein.  This  figure  applies  to  the  entire  activities  section  (similar  graphs 
apply  to  the  phases  and  sense  making  sections).  Notice  specifically  the  highlighting  of  the 
activities  section,  and  the  various  activities  that  take  place  during  each  phase. 
Additionally,  notice  how  several  of  the  preparedness  phase  activities  transition  in  to  the 
activity  of  crisis  management  as  impending  incidents  and  threats  become  present. 

Figure  11.  Understanding  the  Process  of  Incident  Management  (Activities). 

Introduction:  Just  as  important  as  understanding  the  various  types  of  incident 

managers  or  the  various  organizations  and  locations  involved  in  incident  management,  it 

is  also  important  to  define  and  understand  the  various  activities  that  should  be  occurring 

at  those  organizations  and  locations  by  the  various  types  of  incident  managers.  Certain 

activities  might  be  performed  by  various  incident  management  actors  or  disciplines, 

while  others  might  be  performed  exclusively  by  a  certain  type  of  incident  manager.  It 

should  be  stated  that  sometimes  a  particular  incident  manager  might  be  expected  to 

perform  activities  traditionally  reserved  for  an  incident  manager  of  a  different  type.  It 

does  not  mean  that  certain  incident  managers  do  more  than  the  defined  roles  and 

responsibilities  for  their  discipline  type;  it  simply  means  they  are  wearing  multiple  hats 
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and  performing  the  duties  of  multiple  incident  manager  types.  This  situation  might  be 
particularly  common  in  smaller  jurisdictions  or  municipalities  where  an  incident  manager 
of  a  certain  type  is  forced  to  carry  the  burden  of  several  incident  manager  types. 
Understanding  what  activities  an  incident  manager  is  expected  to  carry  out,  and  what 
activities  are  inherent  to  what  incident  management  phases,  practitioners,  or  stmctures 
will  help  incident  managers  be  more  effective  and  meet  expectations  appropriately.  It 
should  be  noted  that  the  following  list  of  proposed  definitions  concerns  actions  and  not 
goals,  (i.e.,  the  definition  of  the  action  of  emergency  management  is  not  necessarily  the 
same  as  the  goal.)  The  goal,  for  all  these  activities,  can  probably  be  stated  as  saving  lives, 
property,  and  the  environment.  However,  just  because  that  is  the  goal  does  not  mean  it  is 
appropriate  for  every  actor  to  do  all  the  incident  management  activities  necessary  to 
accomplish  that  goal. 

The  following  definitions  are  proposed. 

1.  Incident  Management 

Incident  management  refers  to  the  combined  activities  performed  by  all 
disciplines  and  professions  during  all  phases  of  the  incident  management  life  cycle. 

Justification:  Regardless  of  whether  an  incident  becomes  an  emergency,  a 
disaster,  or  a  catastrophe,  as  incidents  become  larger  or  more  dynamic  and  complex,  the 
scope  of  the  management  of  that  incident  scales  up  accordingly.  More  disciplines  may 
need  to  become  involved,  department  operations  centers  may  need  to  be  activated, 
emergency  operations  centers  may  need  to  be  activated,  and  they  may  each  have  their 
own  specialized  multi-agency  coordination  groups.  While  each  of  these  various  entities 
may  be  performing  different  activities,  they  are  all  still  working  towards  the  same  goal, 
the  recovery  from  the  incident  (or  incidents)  that  required  their  involvement.  Thus,  these 
collective  efforts,  activities,  and  endeavors  all  fall  under  the  umbrella  of  incident 
management. 
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2. 


Incident  Command 


Incident  command  encompasses  all  of  the  emergency  response  activities  that 
occur  within  the  defined  scene  under  the  purview  and  organizational  structure  and 
authority  of  the  incident  commander  as  defined  by  the  ICS. 

Justification:  The  ICS  is  a  well-defined  and  widely  adopted  framework  outlining 
the  authorities  and  most  effective  organizational  structure  for  managing  incidents  at  the 
scene.  Any  individual  with  responsibilities  for  saving  lives,  property,  or  the  environment 
at  the  scene  of  an  incident  falls  under  the  ICS. 

3.  Crisis  Management 

Crisis  management  is  the  just-in-time  discipline  or  function  of  specific  activities 
of  active  prevention,  protection,  hazard  mitigation,  risk  management,  training,  planning, 
and  other  problem-solving  activities  required  during  the  rapid  onset  of  pre -incident 
awareness  of  a  known  imminent  threat  (posing  generally  limited  organizational  change), 
or  post-incident  at  locations  where  cascading  or  related  incidents  have  yet  to  occur. 

Justification:  A  crisis  can  be  defined  in  many  different  ways,  but  unfortunately, 
none  are  very  satisfying  in  relation  to  incident  management  (see  the  literature  review). 
Little  consensus  has  been  reached  for  what  a  crisis  means  specifically.  As  described  in 
the  literature  review,  the  common  preeminent  perspectives  within  crisis  theory  seem  to 
place  the  responsibility  of  crisis  management  on  the  person  or  organization  to  which  the 
crisis  is  happening,  which  can  be  compared  to  people  in  middle  of  a  psychological 
breakdown  acting  as  their  own  therapist.  This  approach  seems  foolhardy  when  defining 
or  operating  as  a  crisis  manager,  and  actually,  creates  a  bit  of  a  paradox  as  many 
definitions  of  a  crisis  have  elements  describing  them  as  unmanageable  (the  paradox  in 
other  words  is  being  a  manager  of  the  unmanageable).  It  seems  more  appropriate  to  view 
crisis  managers  as  an  outside  force  who  attempt  to  stabilize,  marginalize,  or  isolate  a 
crisis  from  the  outside,  especially  if  that  external  crisis  stands  as  a  threat  to  their  own 
organization  or  capability.  Thus,  for  the  definition  provided  previously,  crisis 
management  is  the  use  of  discipline  and  function  specific  capabilities,  tools,  assets,  and 
resources  to  eliminate  or  reduce  the  existing  threat.  It  should  be  noted  that  only  those 
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with  assets,  resources,  capabilities,  and  authorities  to  prevent,  protect,  and  mitigate 
threats  actively  participate  in  crisis  management.  Since  incident  commanders  have  an 
already  existing  incident  and  defined  scene  to  manage,  and  since  prevention  and 
protection  and  mitigation  activities  would  fall  under  the  umbrella  of  incident  command  or 
response  activities  on  scene,  it  does  not  seem  appropriate  to  apply  the  term  crisis 
management  to  incident  command  scenarios.  DOCs  and  function  specific  operations 
centers  with  control  over  response  assets  (like  Federal  Bureau  of  Investigation  (FBI) 
crisis  management  centers,  cyber-security  operations  centers,  public  works  operations 
centers,  etc.)  and  have  access  to  threat  or  hazard  intelligence  is  where  crisis  management 
most  commonly  takes  place.  Since  EOCs  do  not  have  direct  operational  control  over  field 
assets  that  would  do  the  active  threat  prevention,  target  protection,  damage  mitigation, 
etc.,  very  little  crisis  management  occurs  at  EOCs,  and  generally,  only  passively.  It 
should  be  noted  that  crisis  management  activities  might  occur  long  after  an  incident 
occurs.  For  example,  if  a  threat-specific  incident  occurs,  say  a  bombing  of  some  sort,  it  is 
uncertain  if  other  potential  targets  exist,  but  a  known  threat  to  those  targets  may  exist, 
and  active  measures  to  protect  and  reduce  exposure  to  those  targets  may  have  to  happen. 
Or,  after  an  earthquake,  for  example,  several  incident  scenes  may  be  related  to  the 
immediate  damage  of  the  earthquake,  but  impending  incidents  may  be  related  to 
infrastructure  or  life  safety  that  might  require  a  crisis  response  (actions  that  might  be 
considered  mitigatory  in  nature  had  the  response  phase  not  been  initiated). 

4.  Emergency  Management 

Emergency  management  refers  to  the  collaborative  senior  and  executive  level 
strategic  decision-making  and  support  coordination  amongst  various  functions  and 
disciplines  within  a  larger  organization  containing  various  departments,  disciplines,  or 
professions. 

Justification:  At  EOCs,  and  other  support  centers,  senior  leaders  from  various 
functions,  disciplines,  and  professions  collaborate  to  create  strategy  and  policy  guiding 
incident  command  support,  crisis  management  priorities,  public  information,  recovery, 
mass  care  and  shelter,  evacuation  support,  etc.  Very  few,  if  any  field  or  operational 


76 


assets,  are  directly  controlled  from  the  EOC.  EOCs,  using  information  received  from 
DOCs  and  field  units,  create  the  strategies  and  policies  to  be  carried  out  operationally  by 
DOCs  to  support  incident  command  activities,  crisis  management  activities,  and  victim 
support  activities. 

5.  Risk  Management 

Risk  management  is  the  activity  of  adjusting  preparedness  activities  to  reduce  the 
risk  to  an  acceptable  level.  The  smaller  the  gap  between  preparedness  and  vulnerabilities, 
the  closer  the  goal  of  being  prepared  is. 

Risk:  The  gap  between  preparedness  and  vulnerabilities  weighted  by  probability 
and  severity. 

Vulnerability:  The  combination  of  known  and  unknown  hazards,  threats,  and 
capability  deficiencies  as  determined  by  assessments. 

Assessment:  The  risk  management  activity  of  increasing  the  knowns  and 
reducing  the  unknowns  associated  with  vulnerabilities  and  their  inherent  probabilities  and 
severities,  as  well  as  increasing  awareness. 

Hazard  Assessment:  Determining  vulnerabilities  associated  with  exposure  to 
pre-existing  natural  and  man-made  conditions,  events,  or  circumstances  that  could  lead  to 
or  contribute  to  an  unplanned  or  undesirable  event. 

Threat  Assessment:  Determining  vulnerabilities  associated  with  credible  and 
serious  threats  of  intent,  as  well  as  the  likelihood  that  they  will  be  carried  out  in  the 
future. 

Capabilities  Assessment:  Determining  vulnerabilities  associated  with 
knowledge,  resource,  and  skills  performance  deficiencies. 

Justification:  The  less  robust  the  hazard,  threat,  and  capabilities  assessments  are, 

the  greater  the  unknown  vulnerabilities  and  their  potential  probabilities  and  severities  are. 

The  greater  the  unknown  vulnerabilities  are,  the  lower  the  dependability  of  the 

vulnerability  factor  is.  The  lower  the  dependability  of  the  vulnerability  factor  is,  the  more 

difficult  the  gap  between  preparedness  and  vulnerabilities  is  to  define.  The  lower  the 
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preparedness  and  vulnerability  gap  definition  is,  the  higher  the  risk  becomes.  The  higher 
the  risk  becomes,  the  more  difficult  risk  management  becomes.  The  more  difficult  risk 
management  becomes,  the  harder  it  becomes  to  reach  the  goal  of  being  prepared. 

6.  Recovery 

Recovery  includes  all  the  post-incident  response  actions  taken  to  return  to  a 
normal  or  new  normal  state  to  include  site  remediation,  evacuee  repatriation,  cost 
recovery,  disaster  assistance  center  establishment,  expedited  building  permit  centers, 
cyber-infrastructure  repair  or  reactivation,  etc. 

Justification:  Just  because  the  threat  or  hazard  has  been  contained,  removed,  or 
has  ended,  does  not  mean  that  elements  related  to  the  incident  may  not  still  need 
managing.  The  consequences  of  the  damage  caused  by  the  incident  still  need  to  be 
managed  to  ensure  long-term  adverse  effects  are  not  incurred  due  to  the  damage  or 
incident  response  operations,  which  is  the  consequence  management  aspect  of  incident 
management.  Much  of  the  initial  consequence  management  is  coordinated  by  EOCs  as 
part  of  the  strategic  support  and  coordination  activities.  Eventually,  however,  EOCs 
deactivate  and  the  continued  long-term  recovery  operations  are  managed  by  various 
functions,  departments,  or  support  centers. 

7.  Prevention 

Prevention  relates  to  the  act  of  actively  or  passively  reducing  or  interdicting  the 
occurrence  of  incidents  caused  by  hazards  or  threats. 

Justification:  Actively  preventing  a  human  threat  may  include  arresting  someone 
based  on  actionable  intelligence,  while  passively  preventing  a  human  threat  may  include 
advertising  an  increase  in  surveillance  activity,  and  thereby,  deterring  potential  attackers 
(it  can  be  debated  whether  deterrence  is  in  fact  prevention).  Actively  preventing  a  hazard 
or  natural  threat  is  not  the  same  as  mitigating  it  (like  using  sand  bags  to  mitigate  flood 
damage.  The  flood  is  not  prevented;  only  the  damage  has  been  mitigated).  Preventing  a 
hazard  or  natural  threat  incident  is  difficult  and  sometimes  impossible  (i.e.,  stopping 
earthquakes).  Using  vaccines  to  prevent  the  spread  of  dangerous  diseases  and  viruses  is 
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one  example  of  the  prevention  of  natural  threats  or  hazards.  Releasing  sub-surface 
thermal  pressure  to  stop  a  volcano  from  erupting  would  be  another  example  of  the 
prevention  of  a  natural  threat  or  hazard. 

8.  Protection 

Protection  is  the  act  of  increasing  the  active  security  posture  or  presence  for  any 
potential  suspected  or  known  target  (human,  building,  or  infrastructure). 

Justification:  Like  prevention,  protection  is  not  mitigation.  An  action  taken  to 
reduce  the  amount  of  damage  something  might  take  due  to  the  occurrence  of  an  incident 
(hazard  or  threat)  is  a  mitigation  measure.  Protection  is  the  increasing  of  active  security 
around  a  known  or  suspected  target.  The  term  target  denotes  human  intent,  and  thusly, 
requires  an  active  conscious  security  awareness  and  presence  through  volition.  The  only 
difference  between  active  and  passive  protection  is  the  existence  of  a  known  active  threat 
or  aggressor. 


9.  Hazard  Mitigation 

Hazard  mitigation  relates  to  the  act  of  reducing  exposure  to  and  the  severity  of 
hazards,  vulnerabilities,  system  failures,  and  threats. 

Justification:  Any  action  not  preventing  an  incident  from  happening  (prevention) 
or  actively  securing  or  protecting  (protection)  designed  to  increase  the  resilience, 
survivability,  or  redundancy,  and  reduce  potential  damage  or  threat  or  hazard  exposure 
would  be  considered  a  mitigation  measure.  Putting  sand  bags  out  to  create  a  barrier  to 
flood  waters  is  an  example  of  a  mitigation  measure.  Putting  shatter  resistant  glass  on  a 
building  or  vehicle  may  be  considered  a  mitigation  measure.  Adding  communications 
channels  or  mechanisms  to  an  operations  center  may  be  considered  a  mitigation  measure. 
Hardening  a  facility  to  reduce  the  damage  caused  by  explosions  can  be  considered  a 
mitigation  measure.  Creating  an  auto-backup  capability  for  cyber-infrastructure  may  be 
considered  a  mitigation  measure.  Reinforcing  a  building  to  ensure  occupants  are  not 
injured  by  falling  walls  or  objects  in  an  earthquake  is  an  example  of  a  mitigation 
measure.  Delineating  between  mitigation,  prevention,  and  protection  is  key,  as  it  helps 
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define  functional  roles  and  responsibilities,  and  appropriate  mission  spaces  based  on 
authority  and  function. 

10.  Planning 

Planning  is  the  process  of  defining  roles  and  responsibilities,  actions,  capabilities, 
and  procedures  related  to  scenarios  or  functions,  as  well  as  the  process  for  creating  tasks, 
objectives,  strategies,  and  priorities  during  an  incident. 

Justification:  During  the  preparedness  phase  of  incident  management,  planning  is 
used  to  pre-determine  the  actions  to  be  taken  by  various  stakeholders  or  functions  in  the 
event  of  a  general  or  specific  incident.  During  the  incident  response  phase  of  incident 
management,  planning  is  used  to  establish  an  appropriate  operational  tempo  and  create  an 
action  plan  outlining  the  tasks,  objectives,  strategies,  and  priorities  for  the  specific 
incident.  In  the  consequence  management  phase  of  incident  management,  planning  is 
used  to  determine  the  roles  and  responsibilities  of  various  departments  and  stakeholders 
and  outline  specific  recovery  priorities  and  procedures  germane  to  the  particular  incident. 

11.  Training 

Training  encompasses  the  actions  taken  to  increase  incident  managers’  individual 
or  group  knowledge,  skills,  and  abilities  related  to  their  specific  incident  management 
roles  and  responsibilities  before  or  during  an  incident. 

Justification:  Training,  whether  it  is  well  in  advance  or  just-in-time,  is  crucial  to 
the  success  of  incident  management.  Having  the  necessary  KSAs  to  execute  an  incident 
management  function  effectively  is  what  ensures  the  greatest  success  and  effectiveness  of 
the  entire  incident  management  structure  and  framework.  Having  the  knowledge  of  the 
system  and  the  function  specific  details,  combined  with  the  refined  abilities  and  trained 
skills,  is  the  best  measure  of  ensuring  individual  and  group  incident  management 
competence. 
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G. 


MISSION  SPACES 


As  presented  in  Figure  12,  the  mission  spaces  discussed  are  ICS  support,  strategic 
support  and  coordination  (emergency  management),  extended  strategic  support  and 
coordination,  area  command,  unified  command,  unified  area  command,  extended  ICS 
support,  and  elected  officials. 


This  figure  is  a  conceptual  diagram  of  the  various  mission  spaces  of  organizations  and 
practitioners  of  incident  management  and  their  relation  to  the  incident.  It  applies  to  the 
entire  mission  spaces  section.  Notice  specifically  the  policy  advisory  group  (PAG) 
relation  to  the  EMC  and  area  command  organizations  and  how  their  executive  authority 
over  their  various  departments  relates  to  the  other  organizational  components. 


Figure  12.  Understanding  Incident  Response  Mission  Space. 


Introduction:  Once  incident  managers  understand  what  type  of  incident  they  are 
involved  in,  what  type  of  incident  management  practitioner  they  are,  what  organizational 
structure  they  are  operating  in,  what  specific  incident  management  activities  they  are 
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performing,  and  what  phase  of  the  incident  they  are  operating  in,  the  next  key  aspect  of 
understanding  is  their  area  of  responsibility,  area  of  focus,  and  authority.  Understanding 
what  aspects  of  the  incident  these  incident  managers  are  applying  to  their  organizational 
focus  and  activities  on  is  key  to  ensuring  that  unnecessary  overlap,  redundancy,  and 
mission  creep  is  not  occurring.  For  example,  as  an  emergency  manager  in  a  national  level 
emergency  management  center  during  a  major  disaster,  then  the  focus  probably  will  not 
be  on  organizing  the  same  strategic  support  and  coordination  that  the  emergency 
managers  in  the  local  EMCs  are  organizing;  instead  the  focus  will  be  on  the  national  level 
strategic  coordination  and  support  to  the  local  EMCs.  The  same  may  be  true  of  an  area 
commander  not  focusing  on  the  tactics  at  the  scene  on  which  an  incident  manager  may 
already  be  focusing.  These  various  areas  are  called  mission  spaces.  Understanding 
organizational  mission  space  will  help  ensure  the  necessary  activities  are  happening  at  all 
the  various  levels  of  incident  management  during  incidents  of  any  size  or  complexity. 

The  following  definitions  are  proposed. 

1.  Incident  Command  System  Support 

The  incident  command  mission  space  is  everything  (to  include  assets  and 
personnel)  within  the  designated  single  incident  area  and  under  the  authority  of  the 
incident  commander  or  unified  commanders’  authority. 

Justification:  The  incident  command  system  mission  space  is  limited  to  the 
boundaries  of  the  single  designated  incident  area  to  ensure  the  appropriate  span  of 
control,  proper  safety  oversight,  and  focus  of  roles  and  responsibilities.  With  authority 
over  one  incident,  the  incident  commander  makes  tactical  decisions  to  address  the  safety 
of  life,  property,  and  the  environment.  Everything  (to  include  support  personnel  at  the 
scene,  such  as  utility  workers,  critical  incident  stress  management,  etc.)  is  under  the 
authority  of  the  incident  commander. 

2.  Strategic  Support  and  Coordination  (Emergency  Management) 

Strategic  support  and  coordination  relating  to  emergency  management  is  an 
activity  happening  outside  of  the  designated  incident  area  (but  potentially  within  the 
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larger  geographical  disaster  area  causing  the  incidents),  but  within  the  local  jurisdiction 
or  municipality  containing  the  incidents.  The  authorities  of  incident  command  and 
strategic  support  and  coordination  do  not  overlap. 

Justification:  Strategic  support  and  coordination  activities  occurring  at  EMCs 
and  other  support  centers  do  not  take  place  within  the  designated  incident  scene  because 
their  focus  is  greater  than  the  incident  itself.  Strategic  support  activities  are  focused  on 
the  continuity  of  government  services,  the  availability  of  resources  to  the  incidents,  and 
the  response  or  support  activities  occurring  outside  of  the  incident  scene  (shelters, 
evacuation  centers,  routes,  etc.).  Once  support  assets,  personnel,  etc.  arrive  at  the  scene  of 
an  incident,  or  at  the  staging  area,  they  are  under  the  authority  of  the  incident  commander 
and  fall  under  the  ICS.  Strategic  support  and  coordination  may  be  happening  at  several 
levels  (local,  state,  federal,  international)  at  the  same  time  depending  on  the  combined 
size  and  complexity  of  the  event. 

3.  Extended  Strategic  Support  and  Coordination 

Extended  strategic  support  and  coordination  refers  to  the  strategic  support 
coordination  occurring  in  support  of  the  local  government’s  strategic  support  and 
coordination  activities. 

Justification:  Often  in  large  complex  events,  county,  state,  and  federal  agencies 
activate  operations  centers  in  direct  support  of  major  incidents  that  happen  at  a  local  level 
or  in  a  municipality.  These  operations  centers  may  support  field  (tactical  ICS)  level 
activities  with  resource  allocation,  or  they  may  support  the  strategic  support  and 
coordination  occurring  at  the  local  level  through  finance  operations,  sheltering 
operations,  legal  policy  and  code  creation  or  council,  public  information  support,  etc.  In 
that  case,  they  are  supporting  the  support  and  coordination  efforts  in  an  extended  manner. 

4.  Area  Command 

Area  command  is  the  singular  consolidated  authority  structure  established  to 
prioritize  incidents,  broker  scarce  or  limited  resources,  and  support  various  incidents  with 
several  incident  commanders  or  an  incident  that  has  become  too  geographically  or 
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jurisdictionally  large  or  diffuse  to  have  a  single  incident  commander.  It  is  organized  in  an 
ICS-centric  structure  to  support  field  ICS. 

Justification:  When  various  incidents  are  taking  place  in  a  jurisdiction  or 
amongst  various  jurisdictions  with  limited  response  resources,  a  brokering  authority  must 
be  established  to  determine  who  will  receive  those  scarce  resources.  Additionally,  when 
an  incident  has  become  so  large  or  complex  (a  large  wildfire,  for  example)  that  a  single 
incident  commander  cannot  effectively  maintain  control  or  oversight  of  the  safety  and 
tactics  at  the  scene,  then  several  incident  commanders  may  be  established  to  address 
defined  geographical  or  incident  specific  areas  over  which  a  single  coordinating, 
prioritizing,  and  support  authority  should  be  established,  being  the  area  commander. 

5.  Unified  Command 

A  unified  command  includes  the  collaborative  leadership  and  command  amongst 
commanders  of  various  response  disciplines  during  complex  incidents  with  no  clear 
discipline  lead,  or  amongst  commanders  of  the  same  discipline  when  a  single  incident 
impacts  multiple  jurisdictions  and  resources  must  be  shared  but  are  not  scarce  or  limited. 
It  is  organized  in  an  ICS-centric  structure  to  support  field  ICS. 

Justification:  Emergency  response  agencies  often  have  areas  of  responsibility. 
When  an  incident  borders  on  their  area  of  responsibility  and  that  of  another  agency’s,  it 
likely  requires  a  collaborative  response  approach,  while  still  maintaining  authority  of  the 
agency’s  respective  assets  and  tactics,  which  is  one  scenario  where  unified  command  is 
appropriate.  Another  example  may  be  a  complex  incident  requiring  the  response  and 
leadership  of  multiple  disciplines  like  a  bombing  where  multiple  victims  require 
emergency  medical  service  response  and  control,  but  the  potential  continued  security  risk 
dictates  leadership  and  control  by  law  enforcement,  and  the  potential  existence  of 
hazardous  materials  may  require  the  leadership  and  control  of  fire  or  hazardous  materials 
(HAZMAT)  teams,  which  is  just  one  example  of  a  complex  incident  that  might  require 
the  use  of  a  unified  command.  Another  example  may  include  the  inclusion  of  private 
industry.  A  unified  command  generally  only  exists  as  a  transitional  state  of  being  for 
incident  command  and  management.  It  exists  until  uncertainty  becomes  certain,  as 
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disorder  transitions  through  chaos  to  complexity.  It  primarily  only  exists  during  chaos 
and  early  complexity.  It  necessitates  fluidity. 

6.  Unified  Area  Command 

A  unified  area  command  includes  the  collaborative  leadership  and  command 
amongst  commanders  of  various  response  disciplines  when  multiple  complex  incidents 
with  no  clear  discipline  lead  exist,  or  amongst  commanders  of  the  same  discipline  when  a 
single  incident  impacts  multiple  jurisdictions  and  resources  must  be  shared  and  are  scarce 
or  limited,  but  no  obvious  agency  lead  can  be  determined  or  agreed  upon.  It  is  organized 
in  an  ICS -centric  structure  to  support  field  ICS. 

Justification:  In  a  major  disaster,  several  complex  incidents  may  exist,  or 
multiple  incidents  from  various  single  disciplines.  If  all  these  incidents  are  pulling  from 
the  same  scarce  resource  pool,  and  a  collaborative  prioritization  of  incidents  requiring 
those  resources  is  needed  to  ensure  an  effective  collective  response,  then  a  unified  area 
command  may  be  required.  For  example,  during  a  catastrophic  earthquake,  several 
incidents  with  mass  casualties,  several  fire  incidents,  several  HAZMAT  incidents,  and 
several  law  enforcement  related  incidents  may  result.  Several  of  those  incidents  may 
require  resources  from  one  or  more  of  the  other  disciplines.  Additionally,  an  incident  may 
occur  that  if  collectively  prioritized,  may  result  in  a  more  effective  response  than  if 
multiple  incidents  are  prioritized  separately.  Also  multiple  incidents  across  jurisdictions 
may  result  where  it  might  not  be  politically  feasible  to  have  a  single  area  commander 
(when  an  incident  or  incidents  cross  national  borders,  for  example)  and  a  unified  area 
command  may  be  most  appropriate.  It  may  also  apply  when  a  private  agency  is  involved 
or  when  on  private  property.  A  unified  area  command  generally  only  exists  as  a 
transitional  state  of  being  for  incident  command  and  management.  It  exists  until 
uncertainty  becomes  certain,  as  disorder  transitions  through  chaos  to  complexity.  It 
primarily  only  exists  during  chaos  and  early  complexity.  It  necessitates  fluidity. 

7.  Extended  ICS  Support 

Extended  ICS  support  references  the  county,  state,  or  federal  ICS  response 

support  structures,  organizations,  and  operations  centers  beyond  the  local  level  that 
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deploy  assets  and  resources  directly  to  field  level  incident  or  area  commanders.  It  is  often 
organized  in  an  ICS-centric  structure  to  support  field  ICS. 

Justification:  These  structures  are  the  extended  resource  support  sources  that  can 
be  called  upon  in  extremely  complex  or  large  events.  The  county,  state,  or  federal 
government  often  has  response  assets  in  several  of  the  common  and  uncommon  response 
disciplines  that  can  be  leveraged  at  the  local  level  should  they  be  needed. 

8.  Elected  Officials 

Elected  officials  are  the  conduit  between  constituents  and  response  and 
coordination  structures  for  understanding  and  communicating  the  community’s  needs. 
They  politically  enact  policy  established  at  lower  levels,  and  garner  political  and  financial 
support  from  higher  political  offices. 

Justification:  Elected  officials  have  a  key  role  in  supporting  and  reinforcing  the 
incident  management  system.  Key  information  may  be  communicated  about  response  and 
coordination  efforts  to  the  public  through  elected  officials  who  can  often  help  reduce 
potential  interruptions,  conflicts,  or  inefficiencies  due  to  low  public  support. 
Additionally,  elected  officials  can  help  to  enact  policy  that  can  grant  necessary  powers  to 
public  safety  officials  for  response,  or  recovery  measures. 

H.  COMPETENCIES 

As  presented  in  Figure  13,  the  competencies  discussed  are  incident  management 
knowledge,  skills,  and  abilities. 
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This  figure  is  a  conceptual  diagram  of  the  various  practitioners  of  incident  management 
and  their  knowledge,  skill,  and  ability  characteristics  and  development  trends.  It  applies 
to  the  entire  competencies  section.  Notice  specifically  the  areas  of  common  or  similar 
skills  that  might  apply  to  the  various  practitioners.  It  is  particularly  key  in  that  the  five 
arms  are  placed  in  relation  to  their  common  interface,  and  thusly,  their  skills  should 
reflect  that  cross-functional  awareness  and  capability. 

Figure  13.  Incident  Management  Knowledge,  Skills  and  Abilities. 


Introduction:  Among  the  currently  existing  incident  management  doctrine,  core 
competencies  are  defined.  These  core  competencies  help  to  describe  and  define  areas  of 
deficiency  and  performance  within  the  incident  management  enterprise  at  large. 
However,  a  more  granular  level  of  competency  should  be  addressed  at  the  individual 
practitioner  level.  The  competency  of  an  individual  incident  management  practitioner  and 
the  collective  competency  of  all  the  practitioners  within  the  incident  management 
enterprise  inform  the  efficacy  of  the  entire  enterprise.  The  composition  of  individuals’ 
incident  management  competency  should  be  defined  by  their  respective  incident 
management  KSAs.  The  value  of  the  combination  of  KSAs  is  the  measure  of  an  incident 
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management  practitioner.  Understanding  these  integral  parts  to  individual  competency 
will  help  practitioners  understand  their  areas  of  strength  and  weakness,  and  help  define  a 
path  to  improvement.  Incident  management  practitioner  who  increase  their  individual 
competencies  help  to  increase  the  overall  efficacy  and  competency  of  the  incident 
management  enterprise,  like  a  rising  tide  lifting  all  ships. 

The  following  definitions  are  proposed. 

1.  Incident  Management  Knowledge 

Incident  management  knowledge  refers  to  the  awareness,  understanding, 
familiarization,  and  education  about  the  entire  incident  management  universe  that  makes 
it  possible  to  understand  the  lexicon,  concepts,  relationships,  ideas,  and  principles  that 
make  up  the  various  incident  management  doctrinal  elements  and  components. 

Justification:  Exposure  to  the  universe  of  incident  management  in  general  may 
happen  in  a  variety  of  ways,  whether  through  school,  employment,  life  experience,  etc. 
Awareness,  understanding,  familiarization,  and  education  about  the  universe  of  incident 
management  may  be  gained  through  specific  academic  courses  of  study,  through 
literature,  through  work  experience  and  relationships,  conversation  and  debate,  etc.  The 
more  awareness,  understanding,  familiarization,  and  education  attained  about  the  incident 
management  universe,  the  more  knowledge  people  have.  Knowledge  is  the  first  level  of 
competency  required  to  become  a  competent  incident  management  practitioner  within 
any  incident  management  discipline. 

2.  Incident  Management  Skills 

Incident  management  skills  describe  function  and  discipline  specific  capabilities 
provided  through  training  courses  that  qualify  someone  to  perform  in  a  specific  incident 
management  functional  capacity. 

Justification:  After  establishing  a  foundational  knowledge  base,  a  person 
appointed  to  fill  a  functional  position  or  role  at  any  level  within  the  incident  management 
universe  must  then  complete  function  specific  training  to  gain  the  initial  primary  skills 
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needed  to  perform  or  execute  the  assigned  function.  Many  incident  management  training 
courses  may  be  designed  to  provide  both  knowledge  and  skills. 

3.  Incident  Management  Abilities 

Incident  management  abilities  measure  the  proficiency  level  and  refinement  of  the 
skills  gained  through  training  courses  improved  through  practice,  drills,  exercises, 
repetition,  and  dynamic  exposure. 

Justification:  Once  knowledge  and  skills  are  gained,  they  must  be  practiced, 
drilled,  exercised,  and  repeated  to  increase  proficiency,  reaction  time,  confidence,  and 
efficacy. 

I.  PROPOSED  INCIDENT  MANAGEMENT  CONCEPTUAL  MODEL 

CONCLUSIONS 

This  proposed  incident  management  conceptual  model’s  topics  and  sections  were 
determined  by  the  guiding  principles  outlined  at  the  beginning  of  the  section,  derived  as  a 
solution  to  the  literature  review’s  findings  of  doctrinal  shortfalls.  The  best  examples  of 
current  and  past  definitions  of  the  terms  above,  the  FEMA  Glossary  of  Terms,97  The 
Department  of  Homeland  Security  Risk  Lexicon,98  or  Dr.  Blanchard’s  Guide  to 
Emergency  Management  and  Related  Terms,  Definitions,  Concepts,  Acronyms, 
Organizations,  Programs,  Guidance,  Executive  Orders,  &  Legislation.99  Within  these 
documents  you  will  find  over  500  various  definitions  for  the  combined  62  terms  proposed 
in  this  study’s  model.  Many  of  the  terms  in  this  proposed  model  have  no  pre-existing 
definition  in  any  of  the  existing  literature,  such  as  “Incident  Manager”,  surprisingly 
enough.  It  is  not  recommended  that  a  one-for-one  comparison  of  the  proposed  definitions 
and  pre-existing  definitions  be  done,  as  the  value  of  the  proposed  definitions  lies  in  the 
method  of  their  genesis  and  their  complementary  nature,  in  that  they  were  all  created 
together  for  the  purpose  of  synergy  and  are  thus  more  complimentary,  making  the  model 

97  “Glossary,”  June  15,  2015,  https://emilms.fema.gov/IS700aNEW/glossary.htm. 

98  “DHS  Risk  Lexicon,”  October  4,  2016,  https://www.dhs.gov/dhs-risk-lexicon. 

99  Blanchard,  Guide  to  Emergency  Management  and  Related  Terms,  Definitions,  Concepts,  Acronyms, 
Organizations,  Programs,  Guidance,  Executive  Orders,  &  Legislation. 
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more  comprehensive  and  thorough.  Applying  these  principles  throughout  the  conceptual 
model,  in  every  topic  and  section,  has  created  a  comprehensive,  consistent,  and  more 
satisfying  model  that  addresses  all  the  necessary  aspects  of  the  incident  management 
enterprise  and  activities.  Perhaps  one  of  the  most  important  conclusions  to  be  taken  away 
from  this  model  is  the  value  in  maintaining  consistent  principles,  paradigms,  and  lens  of 
perspective  in  describing  all  aspects  of  incident  management.  Separating  and  segregating 
topics  as  separate  planning  endeavors  to  be  undertaken  by  different  entities  with  different 
perspectives,  guiding  principles,  and  paradigms  can  create  disjointed  and  gap-riddled 
doctrine.  A  comprehensive  single -effort  approach  of  defining  and  describing  all  aspects 
of  incident  management  concepts  and  components  from  bottom  to  top  creates  a  more 
consistent  and  comprehensive  model.  To  demonstrate  the  value  of  this  approach,  and  of 
this  proposed  conceptual  model,  an  analysis  of  application  is  conducted  by  testing 
retroactively  this  model  on  case  examples  (see  Appendix  B). 
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V.  CONCLUSIONS  AND  RECOMMENDATIONS 


This  section  is  a  summary  of  the  findings,  results,  and  conclusions  of  this  study. 
The  findings  are  derived  from  a  combination  of  the  practitioner  interviews  conducted  in 
the  discovery  and  analysis  portion  of  the  study,  the  incident  management  literature 
review  and  analysis,  the  development  and  synthesis  of  the  proposed  new  incident 
management  conceptual  model,  and  the  application  of  that  framework  to  the  various  case 
examples  (found  in  Appendix  B).  The  following  conclusions  can  broadly  be  described  as 
having  a  focus  on  doctrinal  deficiencies,  where  the  currently  existing  doctrine  makes  up  a 
conceptual  model  with  demonstrated  lacking  utility.  There  are  two  main  categories  of 
findings  and  recommendations.  The  first  is  crisis  philosophy,  operational  movement  of 
resources,  and  the  role  of  DOCs.  The  second  is  regarding  deficiencies  in  existing 
foundational  term  and  concept  definitions.  The  list  of  conclusions  and  recommendations 
follows. 

A.  CONCLUSIONS  REGARDING  CRISIS  PHILOSOPHY,  OPERATIONAL 

MOVEMENT  OF  RESOURCES,  AND  THE  ROLE  OF  DEPARTMENT 

OPERATIONS  CENTERS  (DOCS) 

•  A  doctrinal  gap  exists  in  the  definition  of  “crisis”  as  it  relates  to 
incident  management  as  an  event,  mode,  or  phase.  As  is  explored  in  the 
literature  review,  and  described  in  the  proposed  new  incident  management 
conceptual  framework,  the  definition  of  “crisis”  within  the  incident 
management  lexicon  should  have  a  pre -incident,  threat,  and  mitigatory 
focus,  as  “crisis”  denotes  potential  or  impending  peril  as  a  result  of  un¬ 
intervened  existing  events,  trends,  or  phenomena. 

•  A  lack  of  doctrine  addresses  the  role  of  DOCs  within  the  incident 
management  structure  throughout  the  extent  incident  management 
literature,  doctrine,  and  guidance.  It  is  explored  and  discovered  in  the 
literature  review  that  DOCs  are  all  but  non-existent  in  the  national  incident 
management  literature  and  doctrine,  and  inadequately  touched  upon  in 
most  other  sources  of  incident  management  doctrine  and  guidance.  DOCs 
and  continuity  of  operations  planning  and  guidance  should  perhaps  be 
interrelated  in  national  guidance. 

•  A  lack  of  doctrine  addresses  the  operational  movement  of  resources 
among  or  between  various  incidents.  It  is  explored  and  discovered  in  the 
literature  review  that  resource  movement  outside  or  between  incident 
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command  structures  (separate  incidents)  is  missing  from  much  of  the 
existing  doctrine  and  guidance.  Not  to  be  confused  with  mutual  aid 
structures  (that  are  only  slightly  more  adequately  addressed  in  national 
doctrine),  the  movement  of  resources  belonging  to  one  agency  between 
incidents  is  hardly  discussed,  and  should  probably  be  addressed  in  DOC 
doctrine,  which  is  also  missing  from  most  national  doctrine. 

•  Crisis  management  is  perhaps  most  appropriately  applied  to  the  DOC 
level  of  incident  management  structures.  As  described  in  the  proposed 
new  conceptual  model  lexicon,  it  involves  the  application  of  discipline  or 
function  specific  capabilities,  tools,  assets,  and  resources  to  eliminate  or 
reduce  an  existing  threat.  If  an  incident  has  occurred,  then  it  is  no  longer 
crisis  management  but  incident  command  or  response.  Also,  since  only 
those  with  operational  control  of  assets,  resources,  capabilities,  and 
authorities  to  actively  prevent,  protect,  and  mitigate  threats  using  real-time 
intelligence  participate  in  crisis  management,  this  means  that  crisis 
management  is  not  occurring  at  EOCs  since  EOCs  do  not  have  direct 
operational  control  over  assets  as  DOCs  do. 

•  A  lack  of  doctrinal  delineation  occurs  between  operations  centers  and 
strategic  coordination  centers.  As  demonstrated  in  the  literature  review, 
throughout  the  extent  incident  management  literature,  little  discussion  or 
delineation  is  provided  about  the  differences  between  tactical,  operational, 
and  strategic  coordination  actions.  This  lack  of  definition  is  a  major  gap  in 
the  doctrinal  components  of  incident  management  and  may  be  influencing 
mission  creep  and  organizational  conflict. 

The  following  are  a  list  of  corrective  actions  which  may  help  to  address  the  above 
listed  conclusions: 

•  The  integration  of  “crisis”,  “crisis  management,”,  and  pre-incident 
and  intra-incident  operational  concepts  should  be  improved  in 
incident  management  doctrine  and  it  should  address  moral 
imperative,  operational  movement  of  resources  between  incidents, 
and  discipline  or  function  specific  roles  and  responsibilities  concepts. 
Also,  it  is  necessary  to  improve  this  integration  in  local  policies, 
emergency  operations  plans  (EOPs),  and  annexes  to  EOPs.  This  study’s 
new  proposed  conceptual  framework  potentially  has  examples  of  ways  to 
do  that  integration,  which  will  help  ensure  comprehensive,  holistic,  and 
full-spectrum  incident  management  concepts  are  addressed  at  all  levels 
and  also  help  to  ensure  buy-in  from  all  the  collaborating  incident 
management  enterprise  agencies  and  disciplines. 

•  More  comprehensive  incident  management  doctrine,  guidance,  and 
policy  should  be  created  at  the  federal,  state,  and  local  levels,  which 
integrates  DOCs  specifically  more  intuitively  and  appropriately  to 
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ensure  the  necessary  separation  between  incident  command  and 
incident  support  or  continuity-of-government  functions.  This  study’s 
new  proposed  conceptual  framework  potentially  has  examples  of  ways  to 
do  that  separation.  Doing  so  will  help  to  ensure  inappropriate  mission- 
creep  is  avoided  and  help  to  ensure  that  practitioners  with  the  most 
appropriate  knowledge  and  discipline  specific  authority  are  controlling  the 
movement  of  critical  response  assets.  Most  importantly,  it  will  help  to 
deconflict  and  assist  the  priorities  and  actions  of  the  field  and  EOCs  (or 
EMCs  as  proposed  in  the  conceptual  model). 

B.  CONCLUSIONS  REGARDING  DEFICIENCIES  IN  EXISTING 

FOUNDATIONAL  TERM  AND  CONCEPT  DEFINITIONS 

•  The  definition  of  various  incident  management  disciplines,  actions, 
event  types,  activity  levels,  and  other  key  components,  and  the 
differences  between  them,  need  to  be  more  clearly  delineated  in 
foundational  incident  management  documents.  As  was  described  by 
practitioners  as  an  area  of  frustration  during  the  practitioner  interviews, 
demonstrated  and  explored  during  the  literature  review  and  analysis,  and 
addressed  in  the  proposed  new  incident  management  conceptual  model, 
many  gaps,  obfuscations,  and  areas  of  vague  definition  occur  within 
current  incident  management  doctrine  and  guidance,  which  lends  itself  to 
conflicts  and  operational  degradation,  and  potentially  decreased  public 
safety  and  response.  With  greater  definition  and  clarity,  and  by  closing 
existing  gaps  (as  is  done  in  this  study’s  proposed  new  incident 
management  conceptual  framework)  incident  management  as  an  enterprise 
will  become  more  effective,  and  incident  management  operations  will 
become  more  successful  and  efficient. 

•  Mission  spaces  of  the  various  types  of  incident  management 
practitioners  and  disciplines  within  the  incident  management 
enterprise  are  not  defined,  described,  or  bounded  effectively  enough 
in  the  primary  and  most  widely  referenced  sources  of  incident 
management  doctrine  and  guidance.  This  subject  was  described  as 
frustrating  by  practitioners  during  the  practitioner  interviews,  and  explored 
and  demonstrated  during  the  literature  review  and  analysis,  then  addressed 
in  the  proposed  new  conceptual  model.  A  better  venue  for  national 
dialogue  is  needed  to  determine  the  best  bounding  of  mission  spaces. 

•  Phases  of  incident  management  should  be  used  as  a  tool  for 
conceptual  understanding,  and  three  phases  (preparedness,  incident 
response,  and  consequence  management)  of  incident  management  are 
perhaps  sufficient  for  conveying  the  process.  As  explored  in  the 
literature  review  and  analysis,  and  described  and  defined  in  the  new 
proposed  conceptual  model,  the  use  of  phases  in  recent  federal  doctrine  as 
a  tool  for  understanding  and  conceptualizing  incident  management  has 
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stopped.  However,  still  great  value  can  be  found  in  the  use  of  incident 
management  phases  as  a  tool  for  conceptual  understanding,  and  phases 
have  been  poorly  defined  in  older  doctrinal  and  literature  sources.  The 
phases  of  incident  management  are  an  integral  part  to  understanding  the 
process  and  sense-making  aspects  of  incident  management.  Furthermore, 
three  phases  (preparedness,  incident  response,  and  consequence 
management)  of  incident  management  are  perhaps  best  for  conveying  the 
process,  as  described  in  the  new  proposed  lexicon. 

•  A  difference  exists  between  appropriate  or  necessary  and 
inappropriate  or  unnecessary  mission  creep  in  incident  management, 
as  well  as  a  lack  of  doctrinal  delineation  between  them.  This  topic  was 
mentioned  in  the  practitioner  interviews,  and  validated  within  the  literature 
review.  Interviewees  gave  examples,  such  as  a  county  executing  the 
responsibilities  of  a  city  on  the  city’s  behalf  without  being  asked  or  given 
expressed  permission  when  the  city  has  no  resource  capability  to  execute 
its  roles  and  responsibilities  for  public  safety  as  an  example  of  potentially 
appropriate  or  necessary  mission  creep.  Whereas,  an  EOC  redundantly, 
inadvertently,  or  purposely  directing  tactical  operations  in  the  field  or  at 
the  incident  is  an  example  of  inappropriate  mission  creep. 

The  following  are  a  list  of  corrective  actions  which  may  help  to  address  the  above 
listed  conclusions: 

•  Practitioners  should  ensure  practitioner,  actor,  and  discipline  mission 
spaces  are  bounded  at  the  local  level  through  local  policies,  EOPs,  or 
annexes  to  EOPs.  This  study’s  new  proposed  conceptual  framework  has 
examples  of  ways  to  potentially  do  that  bounding,  which  will  help  to 
deconflict  roles,  responsibilities,  actions,  and  operational  frustrations 
amongst  the  practitioners,  actors,  and  disciplines  that  make  up  the  incident 
management  enterprise  while  also  potentially  increasing  overall  efficacy 
and  efficiency. 

•  The  concept  of  “phases”  of  incident  management  should  be 
reintroduced  into  federal,  state,  and  local  doctrine,  policy,  and 
guidance.  The  use  of  incident  management  phases  as  a  tool  for  conceptual 
understanding  is  still  germane  to  the  doctrine  of  incident  management,  as 
demonstrated  in  this  study’s  proposed  conceptual  model.  The  phases  of 
incident  management  are  an  integral  part  to  the  comprehensive 
understanding  of  the  process  and  sense-making  aspects  of  incident 
management.  Furthermore,  three  phases  (preparedness,  incident  response, 
and  consequence  management)  of  incident  management  are  appropriate 
for  conveying  the  process,  as  demonstrated  in  the  new  proposed  model. 
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APPENDIX  A.  INCIDENT  MANAGEMENT  PRACTITIONER 

INTERVIEW 


“Understanding  Incident  Management” 

David  S  Hamm.  1402 
Advisor:  Glen  Woodbury 
Co- Advisor:  Lauren  Fernandez 

Name: 

Position: 

Years  of  Experience: 

Career  Highlights: 

I.  Are  you  an  incident  manager,  crisis  manager,  emergency  manager,  risk 
manager,  or  some  other  type  of  practitioner? 

This  question  will  help  in  determining  what  an  incident  management 
practitioner  is,  and  where  confusion  might  be  found. 

II.  Have  you  managed  or  participated  operationally  in  a  real  world  incident? 
This  question  will  help  to  legitimize  the  perspectives  of  the  interviewee.  It 
may  also  illuminate  a  point  of  conflict  inherent  in  policy  generation. 

III.  In  your  experience,  what  are  the  primary  sources  of  incident 
management  conflict,  confusion,  or  disagreement,  if  any? 

This  will  hopefully  illicit  an  answer  pointing  at  my  proposed  problem 
statement  without  any  leading  statements  or  questions. 

IV.  Have  you  ever  witnessed  a  hindrance  in  incident  management  operations 
or  activities  due  to  doctrine  interpretation?  Examples? 

This  will  ideally  garner  data  about  historic  conflict  genesis  and  confirm 
aspects  of  my  problem  statement. 

V.  In  your  experience,  have  organizational  differences  or  inconsistencies 
ever  hindered  collaborative  incident  management  operations  or 
activities?  Examples? 

This  question  will  garner  specific  examples  of  my  problem  statement, 
especially  pertaining  to  consistency  in  mutual  aid  operations. 

VI.  Have  you  experienced  or  witnessed  incident  management  mission  creep 
(people  getting  out  of  their  operational  lanes)  due  to  current  incident 
management  doctrine,  plans,  or  policies?  Examples? 

This  will  touch  on  the  lack  of  bounded  mission  space  within  incident 
management,  and  hopefully  provide  specific  examples. 

VII.  Have  you  witnessed  internal  organizational  conflict  due  to  competing 
incident  management  doctrine  interpretations?  Examples? 

This  will  demonstrate  the  vague  nature  of  existing  doctrine,  and  inherent  lack 
of  clarity. 

VIII.  Have  other  practitioners  you’ve  interacted  with  communicated  having 
had  similar  experiences  as  those  identified  in  the  previous  questions? 

This  will  expand  the  legitimacy  of  the  results  of  these  interviews. 
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IX.  What  has  been  the  most  helpful  piece  of  incident  management  literature, 
doctrine,  plans,  or  policy? 

This  will  hopefully  garner  some  consensus  and  allow  me  to  weight  certain 
doctrine/literature  in  my  literature  review  analysis. 

X.  In  your  experience,  what  are  the  primary  contributing  factors  related  to 
operational  performance  in  Incident  Management? 

This  will  ideally  specify  issues  specific  to  operations  increasing  the 
granularity  of  cause  and  effect  analysis. 

XI.  In  your  experience,  what  are  the  primary  contributing  factors  to 
organizational/operational  success  in  incident  management? 

This  will  ideally  specify  issues  specific  to  organizational  makeup  increasing 
the  granularity  of  cause  and  effect  analysis. 

XII.  In  your  experience,  what  are  the  primary  contributing  factors  related  to 
incident  management  philosophy  consistency  or  inconsistency? 

This  will  ideally  specify  issues  specific  to  paradigms  and  philosophies 
increasing  the  granularity  of  cause  and  effect  analysis. 
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APPENDIX  B.  APPLYING  THE  PROPOSED  MODEL  TO  CASE 

EXAMPLES 

Evaluating  examples  of  large  complex  incident  management  events  to  determine 
what  went  well  and  where  room  for  improvement  is  needed,  is  one  way  to  determine  the 
applicability  and  feasibility  of  this  study’s  proposed  conceptual  model.  These  case 
examples  serve  as  a  way  to  test  a  model  on  past  phenomena  much  like  testing  a  theory  of 
stocks  or  commodities  trading  on  historical  graphs  and  activity.  Case  examples  can  also 
help  to  highlight  areas  where  current  models  demonstrate  trends  of  deficiency  or  conflict. 

The  following  models  are  evaluated  in  different  ways  depending  on  the  data  and 
information  available  about  them.  Regardless,  each  is  distilled  into  the  areas  that  worked 
well  that  coincide  with  this  study’s  proposed  model,  and  the  areas  that  proved  deficient 
that  this  study’s  proposed  model  would  potentially  alleviate.  Four  types  of  events  or 
incidents  are  evaluated  to  ensure  all  or  most  types  of  events  are  covered,  and  to 
demonstrate  the  universal  nature  of  this  study’s  proposed  model.  The  four  types  of  events 
include  a  major  recent  Stafford  Act  event,  a  major  recent  Non-Stafford  Act  event,  a 
domestic  terrorist  Non-Stafford  Act  event,  and  an  off-shore  Non-Stafford  Act  event.  The 
specific  events  evaluated  are  Hurricane  Sandy,  the  recent  national  Ebola  Virus  response, 
the  Boston  Marathon  bombing  event,  and  the  recent  Deepwater  Horizon  oil  spill  event. 

A.  2010  DEEP  WATER  HORIZON  RESPONSE  (OFF-SHORE  NON- 
STAFFORD  ACT  EVENT) 

Deepwater  Horizon  serves  as  a  fairly  recent  and  appropriate  example  of  a  large- 
scale  non-Stafford  Act  event  with  all  the  components  of  a  large,  complex,  and  dynamic 
incident  management  structure.  The  following  description  of  the  event  is  derived  from 
the  Coast  Guard  after  action  report: 

On  the  evening  of  April  20,  2010,  an  explosion  aboard  the  Mobile 
Offshore  Drilling  Unit  Deepwater  Horizon  set  off  a  chain  of  events  that 
led  to  the  sinking  of  the  drilling  unit  and  subsequent  oil  spill.  On  April  29, 

2010,  the  Secretary  of  Homeland  Security  declared  the  Deepwater 
Horizon  incident  a  Spill  of  National  Significance  (SONS)  under  the 


97 


authority  of  the  National  Oil  and  Hazardous  Substance  Pollution 
Contingency  Plan  (NCP)  (40  CFR  300.323). 100 

Due  to  the  severity  of  the  spill,  the  complexity  of  response  efforts,  and  the 
potential  impact  on  public  health  and  the  environment,  this  incident 
required  extraordinary  coordination  among  Federal  and  State  agencies, 
tribal  organizations,  local  governments,  and  BP,  the  responsible  party.  The 
response  was  a  coordinated  effort  to  secure  the  well,  and  contain  and  clean 
up  the  oil.  A  day  after  the  declaration  of  the  incident  as  a  SONS,  Admiral 
Thad  Allen,  United  States  Coast  Guard,  was  designated  as  the  National 
Incident  Commander.101 

After  several  attempts,  BP  was  successful  in  securing  the  wellhead  on  July 
15,  2010,  and  sealing  the  well  on  September  19,  2010.  This  incident 
tested,  and  in  some  cases  exceeded,  the  limits  of  the  Nation’s  oil  spill 
response  resources  and  capabilities  developed  after  the  1989  Exxon 
Valdez  oil  spill  in  Alaska.  The  scope  and  duration  of  the  Deepwater 
Horizon  oil  spill  presented  complex  challenges  to  the  response 
community.  These  challenges  provided  the  catalyst  to  adapt  proven 
technologies,  employ  new  or  innovative  technologies,  and  apply  ever- 
changing  response  tactics  to  address  a  dynamic  response  environment.102 

In  2011,  the  Coast  Guard  completed  an  incident  specific  preparedness  review 
(ISPR)103  on  the  BP  Oil  Spill  commonly  referred  to  as  the  Deepwater  Horizon  Incident. 
To  evaluate  this  event  in  relation  to  this  study’s  proposed  conceptual  model,  some  of  the 
Coast  Guard’s  report  findings,  observations,  and  recommendations  are  evaluated  to 
determine  where  the  proposed  model  might  have  closed  gaps,  removed  deficiencies,  or  is 
in  conflict  with  the  findings. 

1.  Conclusions  in  Support  of  Proposed  Model 

•  A  section  of  the  conclusions  surrounding  the  organization  of  the  event 
points  to  appointed,  executive,  and  elected  officials  having  a  key  role  in 
the  overall  response.104  This  key  role  demonstrates  as  evidence  that  like 


100  Robert  J.  Papp  Jr.,  “Incident  Specific  Preparedness  Review  (ISPR) — Deepwater  Horizon  Oil  Spill” 
(memorandum,  U.S.  Coast  Guard.  Department  of  Homeland  Security  March,  201 1),  http://www. 
uscg.mil/foia/docs/DWH/BPDWH.pdf. 

101  Ibid. 

102  Ibid. 

103  Ibid. 

104  Ibid.,  57-61. 
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the  proposed  model  demonstrates,  elected  officials  and  executives  are 
indeed  a  part  of  the  incident  management  enterprise,  and  its  success  and 
should  be  considered  in  doctrine  as  such. 

•  This  document  consistently  hails  the  ICS  as  being  an  effective  system,  as 
demonstrated  in  the  following  quotes:  “...ICS  is  well  understood,  accepted 
and  utilized  by  most  State  and  local  emergency  managers  and  the  oil  spill 
response  community.”105  Also,  “...the  ICS  organization  worked  well 
during  this  event.”106  This  praise  demonstrates  that,  at  least  at  the  incident 
level,  ICS  should  continue  to  be  the  system  of  practice,  as  is  outlined  in 
this  study’s  proposed  model. 

•  The  document  states,  “Leaders  who  are  expected  to  perform  as  crisis 
managers  need  to  be  trained  and  experienced  in  crisis  management,  and 
should  not  be  placed  into  such  positions  without  applicable  training.”107 
This  statement  supports  the  proposed  model’s  description  of  crisis 
managers  and  that  elected  officials  need  to  develop  skills  and  abilities  just 
like  all  other  incident  management  practitioners. 

•  According  to  the  review,  “White  House  and  senior  DHS  staff  were 
initially  unfamiliar  with  the  NCP  response  processes  and  their  application 
to  the  Deepwater  Horizon  incident,  which  caused  some  confusion  among 
senior  leadership  during  the  first  few  days  of  the  response.”108  In  addition, 
“There  is  a  natural  inclination  for  local  officials  to  veer  towards  a  Stafford 
Act  response  under  the  NRF  because  they  are  familiar  with  it  and  have 
greater  control,”109,  and  finally,  “There  is  a  natural  inclination  for  local 
officials  to  veer  towards  a  Stafford  Act  response  under  the  NRF  because 
they  are  familiar  with  it  and  have  greater  control.”110  These  observations 
and  findings  demonstrate  that  event  or  scenario  specific  frameworks  and 
models  are  not  intuitive,  as  evidenced  by  the  desire  for  local  governments 
to  utilize  Stafford  Act  models  due  to  their  familiarity.  One  standard  model 
for  all  event  types  should  be  instituted. 

•  Additionally,  the  findings  and  observations  of  this  review  demonstrate  that 
a  duplicity  or  variances  in  doctrines  is  a  hindrance  to  incident  management 
success.  The  following  observation  is  an  example,  “During  this  incident, 
there  was  extensive  confusion  between  doctrines  set  forth  in  the  NRF  and 
the  NCP.  The  ‘emergency  management’  community,  comprising  State  and 


105  Papp  Jr.,  “Incident  Specific  Preparedness  Review  (ISPR) — Deepwater  Horizon  Oil  Spill,”  71. 

106  Ibid.,  4. 

107  Ibid.,  60. 

108  Ibid.,  64. 

109  Ibid.,  71. 

110  Ibid. 
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local  emergency  management  officials,  was  unfamiliar  with  the  NCP  and 
the  ‘oil  spill  response’  community  did  not  see  the  applicability  of  the  NRF 
to  an  oil  spill.” 1 1 1 

•  The  following  observation  demonstrates  the  need  to  integrate  the  concept 
of  crisis  better  into  incident  management  doctrine,  “Superb  crisis 
leadership  is  essential  for  effective  response  to  a  major  national  domestic 
incident.”112 

•  One  observation  stated,  “Organizational  structures  were  not  in  place  prior 
to  the  incident  to  accommodate  the  use  of  both  the  NCP  and  the  NRF.”113 
However,  if  one  consistent  model  for  all  events  was  used,  as  this  study 
proposes,  it  would  not  be  an  issue. 

•  The  following  observation  and  finding  demonstrates  that  stimulus  events 
need  to  be  better  defined,  “The  NRF  created  the  basis  for  preparedness  for 
State  and  local  officials  in  planning  for  Stafford  Act  responses.  The  NRF 
does  not  contemplate  an  oil  spill  as  an  initiating  event  under  the  NRF. 
Environmental  incidents,  generally,  fall  outside  the  ambit  of  the  National 
Planning  Scenarios,  which  inform  preparedness  activities  under  the 
NRF.”114  This  study  attempts  to  close  this  gap  by  providing  illumination 
to  stimulus  event  types  that  allows  for  greater  universal  categorization. 

2.  Conclusions  Not  in  Support  of  Proposed  Model 

•  Throughout  this  document,  the  terms  “crisis  leadership”  and  “crisis 
management”  are  used  somewhat  interchangeably  without  great  definition 
or  specificity. 1 15  It  also  points  out  that  elected  officials  and  “leaders”  are 
crisis  managers.116  This  viewpoint  is  specifically  in  conflict  with  the 
proposed  model,  which  identifies  elected  officials  specifically  as  crisis 
leaders,  but  specifically  excludes  them  from  the  category  of  crisis 
managers.  While  crisis  management,  and  seemingly  synonymously  crisis 
leadership,  seems  to  be  popularly  recognized  as  the  interface  with  the 
public  and  public  perception  management,  as  this  study  highlights,  a  need 
does  exist  for  greater  definition  in  regards  to  the  concept  of  “crisis.”  It  is 
another  example  of  how  the  term  crisis  is  thrown  around  with  cavalier 
disregard  for  specificity. 


1 1 1  Papp  Jr.,  “Incident  Specific  Preparedness  Review  (ISPR) — Deepwater  Horizon  Oil  Spill,”  71. 

112  Ibid.,  60. 

113  Ibid. 

114  Ibid.,  71. 

115  Ibid.,  60. 

116  Ibid.,  57. 
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•  According  to  the  review  ICS  and  National  Incident  Management  System 
(NIMS)  worked  well.117  In  fact,  several  times,  NIMS  and  ICS  are  referred 
to  synonymously  as  having  worked  effectively.  It  might  be  contended  that 
ICS  worked  well  where  applied,  but  the  fact  that  the  National  Response 
Framework  (NRF)  had  room  for  improvement,118  which  is  a  part  of  the 
NIMS  execution  framework  arguably,  demonstrates  that  the  success  of 
NIMS  should  in  fact  be  considered  separately  of  ICS.  ICS  is  a  field  level 
incident  response  and  command  structure,  where  NIMS  is  the  larger 
description  of  the  entire  incident  management  endeavor,  which  obviously 
had  flaws  based  on  the  number  of  findings  and  observations.  To  address 
the  two  collectively  is  disingenuous  and  serves  little  purpose  for  future 
improvement. 

•  It  is  stated  throughout  this  review  that  the  “national  incident  commander 
model”  uniquely  instituted  for  this  event  worked  well.119  Yet,  the  national 
incident  commander  for  this  event  consistently  is  referred  to  as  a  “crisis 
manager”  in  this  review.120  However,  this  reference  lends  itself  to  the  idea 
that  incident  command  and  crisis  management  are  synonymous.  Whereas, 
the  need  for  a  “person  in  charge”  is  called  for  several  times.121  Yet,  it  is 
highlighted  that  this  person  needs  strong  “crisis  management”  and  “crisis 
leadership”  skills,  not  incident  command  skills.  It  would  seem  that  the 
moniker  of  “incident  commander”  is  inappropriate  and  should  perhaps  be 
“national  crisis  leader,”  or  “national  crisis  manager.”  The  term  “incident 
commander”  should  be  reserved  for  those  with  positive  control  over  the 
scene  and  responsibility  for  site  safety  and  tactical  control. 

•  It  is  stated  in  the  review,  “The  NRF  is  predicated  on  a  ‘bottom  up’ 
approach  to  crisis  management,  placing  the  responsibility  for  incident 
management  at  the  local  level,  with  support  from  the  State  and  Federal 
governments  only  when  the  incident  exceeds  local  capabilities.  The  NCP 
is  a  ‘top  down’  approach  to  crisis  management,  in  which  the  Federal 
Government  manages  the  response  with  participation  by  States  and  limited 
participation  by  local  governments.”122  However,  the  model  proposed  by 
this  study  recommends  a  more  modular  component  approach  that  does  not 
dictate  a  top-down  or  bottom-up  approach.  It  simply  adds  the  components 
necessary  to  manage  that  incident  based  on  location,  jurisdiction,  and 
necessity.  A  proper  comprehensive  incident  management  framework  or 


117  Papp  Jr.,  “Incident  Specific  Preparedness  Review  (ISPR) — Deepwater  Horizon  Oil  Spill,”  4,  71. 
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model  should  not  be  predicated  on  a  bottom-up  or  top-down  approach 
since  incidents  is  too  dynamic  to  dictate  such  a  stipulation. 

3.  Conclusions  regarding  Deepwater  Horizon 

The  Deepwater  Horizon  event  demonstrated  the  value  of  the  ICS  on  a  large 
complex  and  dynamic  event  in  a  non-Stafford  Act  scenario.  However,  the  many  flaws 
and  issues  of  the  current  NIMS  were  on  display,  particularly  in  regards  to  the  universal 
interpretation  and  implementation  of  such  a  fragmented  and  disjointed  model.  This  event 
served  as  a  great  example  of  the  need  for  incident  management  conceptual  framework 
reform.  That  being  said,  while  many  of  the  observations  and  findings  of  the  after  action 
process  were  valid  and  will  serve  to  improve  the  current  model,  many  continue  to 
propagate  confusions  and  areas  of  conflict  or  lacking  clarity,  such  as  a  definition  of  crisis 
in  regards  to  incident  management. 

Non-Stafford  Act  events  that  occur  off-shore  but  impact  many  local  jurisdictions 
would  be  served  well  by  a  model  that  is  universal  in  its  approach  to  incident  types  and 
governmental  levels.  If  this  study’s  model  were  applied  nationally,  it  would  surely  serve 
to  improve  response  efficacy,  practitioner  understanding,  and  interoperability  and 
collaboration  amongst  agencies.  This  event  is  a  shining  example  that  incident 
management  practitioners  of  any  type  should  not  have  to  shift  their  paradigms  based  on 
the  event,  and  in  fact,  have  a  predilection  not  to. 

B.  2014  DOMESTIC  EBOLA  RESPONSE  (NON-STAFFORD  ACT  EVENT) 

According  to  the  Centers  for  Disease  Control  and  Prevention  (CDC),  since  March 
2014,  West  Africa  has  experienced  the  largest  outbreak  of  Ebola  in  history,  with  multiple 
countries  affected.  The  most  severely  impacted  countries  include  Sierra  Leone,  Guinea, 
and  Liberia.  During  this  outbreak,  of  those  who  have  contracted  the  disease,  two  out  of 
every  five  have  died.  As  of  March  27,  2016,  the  total  cases  (suspected,  probable,  and 
confirmed)  stand  at  28,646,  while  laboratory-confirmed  cases  are  at  15,255,  with  the  total 
death  count  at  11,323.  The  total  count  of  verified  cases  in  the  United  States  currently 
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stands  at  four. 123  The  following  quote  is  an  overview  of  actions  taken  in  response  to  the 
Ebola  outbreak  found  on  the  CDC  website: 


In  response  to  the  outbreak,  CDC  activated  its  Emergency  Operations 
Center  to  coordinate  technical  assistance  and  control  activities  with  other 
U.S.  government  agencies,  the  World  Health  Organization,  and  other 
domestic  and  international  partners.  CDC  also  deployed  teams  of  public 
health  experts  to  West  Africa.  Widespread  transmission  of  Ebola  in  West 
Africa  has  been  controlled,  although  additional  cases  may  continue  to 
occur  sporadically.  However,  because  of  ongoing  surveillance  and 
strengthened  response  capacities,  the  affected  countries  now  have  the 
experience  and  tools  to  rapidly  identify  any  additional  cases  and  to  limit 
transmission. 124 

According  to  the  White  House’s  Office  of  the  Press  Secretary  in  2014  (at  the 
height  of  the  outbreak),  the  President  stated: 

The  Ebola  epidemic  in  West  Africa  and  the  humanitarian  crisis  there  was  a 
top  national  security  priority  for  the  United  States.  In  order  to  contain  and 
combat  it,  the  U.S.  partnered  with  the  United  Nations  and  other 
international  partners  to  help  the  Governments  of  Guinea,  Liberia,  Sierra 
Leone,  Nigeria,  and  Senegal  respond  while  fortifying  defenses  at  home.125 

The  national  strategy,  as  dictated  by  the  White  House,  was  (and  continues  to  be) 
predicated  on  four  key  goals: 

•  Controlling  the  epidemic  at  its  source  in  West  Africa; 

•  Mitigating  second-order  impacts,  including  blunting  the  economic,  social, 
and  political  tolls  in  the  region; 

•  Engaging  and  coordinating  with  a  broader  global  audience;  and, 

•  Fortifying  global  health  security  infrastructure  in  the  region  and 
beyond.126 


123  “2014  Ebola  Outbreak  in  West  Africa,”  accessed  March  13,  2016,  http://www.cdc.gov/vhf/ebola/ 
outbreaks/2014-west-africa/index.html. 

124  Ibid. 

125  “Fact  Sheet,  U.S.  Response  to  the  Ebola  Epidemic  in  West  Africa,”  September  16,  2014,  https:// 
www.whitehouse.gov/the-press-office/2014/09/16/fact-sheet-us-response-ebola-epidemic-west-africa. 

126  Ibid. 
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This  September  2014  White  House  Office  of  the  Press  Secretary  fact  sheet127  is  a 
great  source  of  evaluation  in  relation  to  this  study’s  proposed  conceptual  model,  as  it 
addresses  the  federal  government’s  incident  management  strategies,  its  event  type 
perspective,  its  interoperability  intentions  with  other  incident  management  components, 
and  the  general  lexicon  applied  to  such  an  event.  These  aspects  will  be  evaluated  to 
determine  where  the  proposed  model  might  have  closed  gaps,  removed  deficiencies, 
provided  a  better  lens  for  evaluating  the  threat  or  incident,  or  is  in  conflict  with  the 
national  narrative  at  the  time. 

1.  Elements  in  Support  of  the  Proposed  Model 

•  The  White  House  fact  sheet  refers  to  the  event  as  a  “crisis”  on  several 
occasions.128  Since  an  incident  has  not  occurred  within  U.S.  borders,  but 
is  a  growing  threat  needing  an  outside  response  to  ensure  it  did  not 
adversely  impact  the  organization  (the  organization  being  the  federal 
government  or  the  U.S.  population)  this  event  seems  to  be  a  perfect 
example  of  a  crisis  that  could  easily  be  justified  as  having  a  moral 
imperative  for  response.  This  event  is  exactly  the  type  of  crisis  that  could 
additionally  justify  the  existence  of  a  declaration  of  a  state  of  emergency, 
especially  since  it  requires  the  active  preemptive  or  preventative 
coordination  and  collaboration  of  various  emergency  functions  or 
disciplines. 

•  The  fact  sheet  refers  to  a  “whole-of-govemment”  approach  several 
times.129  This  reference  demonstrates  not  only  a  need  to  apply  incident 
management  principles  and  concepts  but  also  a  need  for  various  levels  or 
components  of  the  incident  management  structure  to  be  applied.  Much  like 
the  Deepwater  Horizon  event,  this  event  has  aspects  that  appear  to  be  “top 
down”-centric,  where  other  aspects  might  require  a  “bottom  up”-centric 
approach  (For  example,  when  an  infected  person  arrives  at  an  airport  and 
local  agencies  are  forced  to  respond).  This  event  is  a  perfect  example  of 
why  a  universal  modular  component  approach  to  incident  management,  as 
is  outlined  in  this  study’s  proposed  model,  is  more  appropriate. 

In  addition  to  the  “whole-of-government”  approach  that  this  fact  sheet  proposes,  it 
also  outlines  the  need  for  cooperative  and  collaborative  efforts  on  an  international  scale, 


127  “Fact  Sheet,  U.S.  Response  to  the  Ebola  Epidemic  in  West  Africa.” 
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particularly  when  it  states  that  the  “CDC  has  provided  on  the  ground  expertise  in  the 
largest  international  response  in  its  history.”130  This  statement  demonstrates  a  need  to 
understand,  at  all  levels,  who  is  filling  what  mission  spaces.  This  study’s  proposed  model 
outlines  the  appropriate  mission  space  for  the  “whole -of-government”  approach,  event 
when  it  includes  foreign  and  international  governments  and  agencies  (such  as  the  World 
Health  Organization  as  this  event  did). 

2.  Elements  not  in  Support  of  Proposed  Model 

•  The  fact  sheet  states,  “More  than  100  CDC  personnel  are  on  the  ground  in 
West  Africa,  and  hundreds  of  personnel  at  their  Emergency  Operations 
Center  in  Atlanta  have  provided  around  the  clock  logistics,  staffing, 
communication,  analytics,  management,  and  other  support  functions.”131 
This  statement  insinuates  that  specific  departments,  representing  specific 
functions,  within  the  federal  government  have  their  own  EOCs,  as 
opposed  to  DOCs,  as  this  study’s  proposed  model  recommends.  As  the 
CDC  is  one  department  (or  office)  under  the  larger  parent  organization 
being  the  federal  government,  it  seems  only  appropriate  that  it  should  have 
a  DOC  that  coordinates  its  specific  functional  response,  where  a  federal 
EOC  would  coordinate  the  medical  health  function  in  relation  to  the  other 
functions  within  the  federal  government  organization.  This  viewpoint 
highlights  an  interesting  area  for  analysis  and  further  study.  The  argument 
can  be  made  that  a  federal  department  is  large  enough  to  encapsulate 
various  functions  and  disciplines  so  it  should  have  an  EOC  for 
collaborative  coordination  and  support.  However,  all  those  various 
functions,  capabilities,  and  disciplines  are  still  focused  on  ensuring  the 
execution  of  the  medical  health  (or  more  specifically,  to  the  CDC 
epidemiological)  function,  which  is  a  specific  disciplinary  function  and 
accordingly  should  be  coordinated  via  a  DOC.  That  being  said,  it  is  an 
interesting  area  for  continued  study.  It  seems  intuitive  that  the  CDC 
operations  center  be  considered  a  DOC  where  the  federal  government 
would  have  one  single  EOC. 

•  The  fact  sheet  states,  “The  Ebola  epidemic  reminds  us  that  our  global 
efforts  to  build  the  capacity  to  prevent,  detect,  and  rapidly  respond  to 
infectious  disease  threats  like  Ebola  have  never  been  more  vital.”132  While 
it  seems  to  be  appropriate,  based  on  the  lexicon  justifications  provided  in 
this  study’s  proposed  model,  to  consider  an  outbreak  like  this  Ebola 


130  “Fact  Sheet,  U.S.  Response  to  the  Ebola  Epidemic  in  West  Africa.” 

131  Ibid. 

132  Ibid. 
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example  a  “crisis”  or  even  a  “crisis”  justifying  a  “state  of  emergency,”  it 
seems  hardly  appropriate  to  consider  it  a  “threat.”  Additionally,  it  seems 
like  it  would  be  better  considered  as  a  possibility  defined  as  a  hazard  or 
vulnerability,  but  not  a  threat  (unless  it  is  used  as  a  biological  weapon)  as 
no  malicious  intent  is  involved  in  its  potential  release. 

3.  Conclusions  regarding  the  2014  Domestic  Ebola  Response 

The  2014  domestic  Ebola  response  demonstrated  an  apparent  need  for  a  universal 
model  that  might  be  applied  to  all  events.  This  event  served  as  a  great  example  of  the 
need  for  incident  management  concepts  to  lend  themselves  to  this  study’s  proposed 
model.  The  need  exists  to  understand  the  difference  between  DOCs  and  EOCs,  the 
difference  between  “threat”  and  “crisis,”  as  well  as  to  understand  and  apply  an  incident 
management  model  that  encapsulates  components  at  the  local  and  international  level. 

While  many  of  the  strategies  and  concepts  of  the  fact  sheet  are  valid  and  will 
serve  to  improve  or  complement  the  current  incident  management  model,  obvious 
examples  of  inherent  confusion,  areas  of  conflict,  or  areas  of  lacking  clarity,  such  as  the 
definition  of  crisis  versus  threat  in  regards  to  incident  management,  are  introduced.  Non- 
Stafford  Act  events  like  the  2014  Ebola  crisis  would  be  served  well  by  a  model  that  is 
universal  in  its  approach  to  incident  types  and  governmental  levels.  If  this  study’s  model 
were  applied  nationally  (or  internationally)  it  would  surely  serve  to  improve  response 
efficacy,  practitioner  understanding,  and  interoperability  and  collaboration  amongst 
agencies.  This  event  is  a  shining  example  that  incident  management  practitioners  of  any 
type  should  not  have  to  shift  their  paradigms  based  on  the  event. 

C.  2013  BOSTON  MARATHON  BOMBING  RESPONSE  (DOMESTIC 

TERRORISM  NON-STAFFORD  ACT  EVENT) 

The  following  quotes  are  an  overview  narrative  description  of  the  2013  Boston 
Marathon  Bombing  taken  from  the  Boston  Massachusetts  after  action  report  for  the 
event: 


April  15,  2013,  was  a  perfect  day  for  running.  The  air  was  cool,  the  sun 
was  shining,  and  the  complex  logistics  supporting  the  117th  Boston 
Marathon  were  operating  smoothly.  Every  participant,  be  they  mobility 
impaired,  wheelchair  racer,  hand-cyclist,  or  runner,  made  their  way  to  the 
Start  Line  with  the  emotions  that  are  typically  part  of  Marathon  Day: 
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excitement,  nervousness  and  a  heartening  spirit  of  perseverance.  By  11:00 
a.m.,  all  27,000  runners  were  on  the  course;  by  12:36  p.m.,  the  winners  for 
each  race  category  had  been  declared. 133 

The  heart  of  the  Boston  Marathon  is  not  about  the  winners;  it  is  about  the 
less  renowned  runners  who  seek  their  own  personal  victories  as  they  make 
their  way  to  Boston;  it  is  about  the  hundreds  of  thousands  of  spectators 
who  flock  to  the  course  to  cheer  them  on;  it  is  about  the  spirit  of 
community,  and  commitment,  and  sacrifice  so  well  reflected  in  the 
Patriots’  Day  holiday  on  which  the  Marathon  takes  place  each  year.  The 
heart  of  the  Boston  Marathon  is  why  so  many  people  were  still  on  the 
sidelines  cheering  on  runners  as  they  reached  the  Finish  Line  in  the 
afternoon  hours  of  April  15. 134 

At  2:49  p.m.,  the  race  was  forever  changed.  Two  homemade  improvised 
explosive  devices  (IEDs)  were  detonated  on  Boylston  Street  in  two 
separate  locations  near  the  Finish  Line.  These  explosions  took  the  lives  of 
three  spectators:  eight-year-old  Martin  Richard,  29-year-old  Krystle 
Campbell,  and  23-year  old  Lu  Lingzi.  An  additional  264  spectators  were 
injured,  many  critically. 135 

This  tragic  event  initiated  a  week-long  response  of  the  public  safety, 
public  health,  and  medical  communities,  which  culminated  in  the  death  of 
one  suspect,  and  the  capture  of  another.  In  spite  of  the  malevolence  of  the 
perpetrators  of  these  actions,  countless  extraordinary  acts  of  heroism, 
bravery  and  community  triumphed. 136 

In  December  2014,  a  multi-disciplinary  and  multi -jurisdictional  after  action 
review  was  coordinated  and  resulted  in  a  comprehensive  after  action  report.  This  report 
details  best  practices,  lessons  learned,  and  recommendations  related  to  this  event.137  This 
after  action  report  is  a  great  source  of  evaluation  in  relation  to  this  study’s  proposed 
conceptual  model,  as  it  addresses  the  governmental  incident  management  strategies 
related  to  threat  and  crisis,  integration  with  various  incident  management  components, 


133  Massachusetts  Emergency  Management  Agency  et  at.,  After  Action  Report  for  the  Response  to  the 
2013  Boston  Marathon  Bombings  (Boston:  Massachusetts  Emergency  Management  Agency  et  at.,  2014), 
http://www.mass.gov/eopss/docs/mema/after-action-report-for-the-response-to-the-2013-boston-marathon- 
bombings.pdf. 

134  Ibid. 

135  Ibid.,  15. 

136  Ibid. 
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disciplines,  levels,  and  the  phases  of  incident  management.  These  aspects  are  evaluated  to 
determine  where  the  proposed  model  may  have  closed  gaps,  removed  deficiencies, 
provided  a  better  lens  for  evaluating  the  threat  or  incident,  or  remains  in  conflict. 

1.  Findings  and  Observations  in  Support  of  the  Proposed  Model 

•  One  of  the  key  best  practices  identified  in  the  after  action  report  was  the 
“strong  relationships  and  successful  unified  command.”138  The  report 
states,  “strong  relationships  created  and  maintained  by  key  leaders  were 
paramount  to  ensuring  commanders,  agency  heads,  and  political  leaders 
came  together  quickly  to  form  Unified  Command  and  facilitate 
collaborative  decision-making  after  the  bombings  in  Boston  and  during 
the  manhunt  in  Watertown.”139  This  finding  is  an  example  of  how  unified 
command,  a  component  recommended  in  this  study’s  proposed  model,  can 
be  used  effectively. 

•  The  timeline  of  events140  highlights  the  extreme  complexity  of  the 
response,  which  justified  the  use  of  a  unified  command,  and  demonstrates 
this  study’s  proposal  that  a  unified  command  should  be  used  in  highly 
complex  incidents  where  a  function  or  discipline  lead  is  not  at  first 
apparent  or  obvious.  Within  the  first  hour  of  the  event,  simultaneous 
priorities  for  site  safety,  medical  response  and  triage,  hazardous  materials 
monitoring,  explosive  ordinance  disposal  and  monitoring,  fire  response, 
etc.  occurred.  This  complexity,  and  initial  scene  uncertainty  and  disorder, 
necessitated  fluidity  in  the  unified  response  of  various  disciplines  and 
required  significant  collaboration.  Yet,  not  one  primary  priority  or 
superseding  priority  would  stipulate  a  single  discipline  or  single  incident 
commander  model.  Furthermore,  as  scene  security  was  established,  and 
the  initial  disorder  transitioned  to  chaos  then  to  complexity,  the  need  for  a 
unified  command  became  no  longer  necessary,  as  demonstrated  by  the 
standing  down  of  the  unified  combatant  command  (UCC)  the  following 
morning.  This  finding  further  supports  this  study’s  proposal  for  how  and 
when  a  unified  command  should  be  implemented,  as  is  stated  in  this  study 
and  demonstrated  in  this  event,  a  unified  command  exists  until  uncertainty 
becomes  certain,  as  disorder  transitions  through  chaos  to  complexity.  It 
primarily  only  exists  during  chaos  and  early  complexity.  It  necessitates 
fluidity. 


138  Massachusetts  Emergency  Management  Agency  et  al..  After  Action  Report  for  the  Response  to  the 
2013  Boston  Marathon  Bombings,  9. 

139  Ibid. 

140  Ibid.,  18-24. 
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•  Another  example  of  this  event’s  support  of  unified  command  concepts  is 
demonstrated  by  the  use  of  a  separate  unified  command  structure 
established  to  coordinate  the  manhunt  in  the  days  following  the  bombing 
incident.141  Due  to  the  unknown  jurisdictional  whereabouts  and  the 
multiple  mission-oriented  law  enforcement  jurisdictions  of  this  event,  a 
single  discipline  or  function  unified  command  structure  was  established 
amongst  the  various  law  enforcement  agencies  involved.  This  finding 
serves  as  another  example  of  a  unified  command  being  used  during 
complex  crisis  management  and  further  supports  this  study’s  proposed 
model  regarding  the  unified  command  concepts. 

•  The  timeline  of  events  outlined  in  this  after  action  report142  is  a  perfect 
example  of  the  phases  of  incident  management  that  this  study’s  model 
proposes.  The  initial  minutes-to-hour  after  the  initial  bomb  blasts  could 
probably  best  be  described  as  disorder,  and  the  initial  organization  and 
activation  of  a  unified  command  to  address  the  various  uncertainties  and 
simultaneous  priorities  serves  as  a  great  example  of  disorder  organizing 
into  chaos,  then  the  transition  from  chaos  to  complexity  was  best 
demonstrated  as  the  scene  became  secured,  victims  triaged  and  transported 
to  hospitals,  HAZMAT  materials  concerns  eliminated,  EOD  sweeps 
completed,  and  the  UCC  stood  down  the  following  morning  (in  less  than 
10  hours143).  Then,  the  continued  complexity  of  transition  occurred  from 
site  security  and  investigation  to  the  eventual  recovery  of  the  scene,  as 
well  as  the  complexity  of  transitioning  response  personnel  focus  to  the 
crisis  management  (pre-incident  known  active  threat  response)  of  finding 
the  perpetrators  who  remained  at  large. 

•  The  manhunt  operations 144  that  took  place  in  the  days  following  the 
bombing  incident  demonstrate  the  crisis  management  or  response 
principles  outlined  in  this  study’s  proposed  model.  The  law  enforcement 
operations  conducted  during  those  days,  and  the  shelter-in-place  direction 
given  to  the  local  population,  demonstrate  a  response  with  a  focus  on 
prevention  and  protection.  Since  a  demonstrated  known  active  threat  (two 
individuals  who  had  demonstrated  a  capability  to  attack  with  malicious 
intent)  had  occurred,  as  well  as  various  potential  pre-meditated  targets  or 
targets  of  opportunity,  all  the  necessary  elements  of  the  crisis  event  type 
were  met.  Additionally,  the  activities  of  the  protection  of  critical 


141  Massachusetts  Emergency  Management  Agency  et  al..  After  Action  Report  for  the  Response  to  the 
2013  Boston  Marathon  Bombings,  113. 

142  Ibid.,  18-24. 

143  Ibid. 

144  Ibid.,  53-68. 
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infrastructure,145  and  the  active  prevention  through  pursuit,  were 
demonstrations  of  the  consolidated  crisis  management  activity. 


•  The  after  action  report  findings  included  the  following  two  areas  for 
improvement,  the  “need  to  clearly  define  emergency  response  roles  and 
responsibilities  within  the  city”,  and  “numerous  command  centers  were 
not  uniformly  coordinated.” 146  This  finding  is  another  example  of  how 
undefined  emergency  response  roles  continue  to  demonstrate  national 
model  conceptual  and  adoption  deficiency  and  support  this  study’s 
problem  statement. 

2.  Findings  and  Observations  not  in  Support  of  Proposed  Model 

•  According  to  the  after  action  report,  one  of  the  best  practices  was  the  fact 
that  a  Multi-Agency  Coordination  Center  (MACC)  was  activated  to  ensure 
support  for  the  marathon  events.  It  goes  on  to  state  that  the  MACC  was 
located  at  the  state  EOC.147  However,  later  in  the  document,  one  of  the 
identified  areas  of  improvement  states  that  the  Boston  EOC  was  not 
activated  prior  to  the  bombings,  which  caused  a  delay  in  a  number  of 
crucial  information  sharing  and  coordination  activities  and  recommends 
activating  the  EOC  in  support  of  future  marathons.148  This  study’s 
proposed  model  suggests  avoiding  the  term  “MACC”  and  instead  calling 
centers  what  their  post-incident  name  would  be  so  as  not  to  force 
personnel  to  go  through  an  unnecessary  paradigm  shift  and  reassign  a  title 
to  something  mid-operation.  Even  this  after  action  report  seems  to 
condone  the  use  of  the  term  EOC  over  MACC  in  its  recommendation  on 
page  87. 

•  Throughout  this  after  action  report,  it  did  not  seem  that  the  manhunt  and 
the  bombing  were  recognized  as  being  two  separate  activities  or  events,  or 
how  or  where  that  delineation  threshold  was  determined.149 
Understanding  and  communicating  that  the  manhunt  was  a  pre-incident 
prevention  and  protection  focused  operation  in  a  state-of-emergency  much 
in  the  same  way  preparedness  and  mitigation  actions  must  be  taken  prior 
to  hurricane  landfall  helps  the  community  understand  the  need  for 
precautionary  measures  to  be  taken,  and  limits  the  perspective  of  overly¬ 
reactionary  or  disproportionate  justice  measures  being  taken.  It  helps 


145  Massachusetts  Emergency  Management  Agency  et  al.,  After  Action  Report  for  the  Response  to  the 
2013  Boston  Marathon  Bombings,  80. 

146  Ibid.,  87-88. 

147  Ibid.,  73. 

148  Ibid.,  87. 

149  Massachusetts  Emergency  Management  Agency  et  al..  After  Action  Report  for  the  Response  to  the 
2013  Boston  Marathon  Bombings. 
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demonstrate  the  reality  of  the  threat,  and  not  the  potentially 
overshadowing  or  misinterpretation  of  protection  or  prevention  measures 
as  vengeance-through-justice. 

•  In  the  timeline  of  events  section  of  this  after  action  report,  it  states  that 
President  Obama  issued  a  declaration  of  emergency.150  This  event  type 
categorization,  while  at  first  glance  seems  appropriate,  is  probably  not  the 
best  classification  for  such  an  event.  Since  the  scene  of  the  incident  had 
been  under  positive  control  at  that  point,  and  a  definitive  imminent 
impending  incident  was  not  known,  but  an  active  imminent  threat  of 
incident  was  occurring,  and  since  an  obvious  crisis  was  being  managed,  it 
would  probably  have  been  more  appropriate,  based  on  the  criteria  set  forth 
in  this  study’s  proposed  model,  to  classify  this  event  as  a  “state -of- 
emergency”  rather  than  an  “emergency.” 

3.  Conclusions  regarding  the  2013  Boston  Marathon  Bombing  Response 

The  2013  Boston  Marathon  Bombing  response  was  a  perfect  example  of  an  event 
where  intuition  dictated  appropriate  response  actions  that  fall  in  line  with  this  study’s 
proposed  model,  further  demonstrating  the  value  of  the  model  and  the  likely  ease  of 
implementation,  and  universality  of  its  concepts  and  principles.  Additionally,  given  that 
this  event  was  not  a  Stafford  Act  event,  it  demonstrated  the  universality  and  broad 
relevance  of  this  study’s  proposed  model.  The  need  to  understand  the  phases  of  incident 
management,  dynamic  incident  management  components  and  nuanced  principles  like 
unified  command,  and  the  value  of  properly  framing  the  description,  response  activity 
justification,  and  dialogue  surrounding  operations  and  event-types  can  positively 
supplement  an  already  successful  operation,  and  potentially,  turn  an  otherwise  negative 
response  positive. 

Non-Stafford  Act  domestic  terrorism  events  like  the  2013  Boston  Marathon 
Bombing  and  the  subsequent  manhunt  crisis  would  be  served  well  by  a  model  that  is 
universal  in  its  approach  to  incident  types  and  governmental  levels.  If  this  study’s  model 
were  applied  to  all  event  types,  it  would  surely  serve  to  improve  response  efficacy, 
practitioner  understanding,  and  interoperability  and  collaboration  amongst  agencies.  This 


150  Massachusetts  Emergency  Management  Agency  et  al.,  After  Action  Report  for  the  Response  to  the 
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event  is  another  shining  example  that  incident  management  practitioners  of  any  type 
should  not  have  to  shift  their  paradigms  based  on  the  event. 


D.  2012  HURRICANE  SANDY  RESPONSE  (STAFFORD  ACT  EVENT) 

The  following  quotes  are  a  description  of  the  Hurricane  Sandy  response,  as 
described  in  the  FEMA  after  action  report  on  the  event: 

Hurricane  Sandy,  the  second-largest  Atlantic  storm  on  record,  affected  the 
East  Coast  from  Florida  to  Maine,  as  well  as  states  as  far  inland  as  West 
Virginia,  Ohio,  and  Indiana.  The  storm  made  landfall  in  southern  New 
Jersey  on  October  29,  2012,  battering  the  densely  populated  New  York 
and  New  Jersey  region  with  heavy  rains,  strong  winds,  and  record  storm 
surges.  The  storm’s  effects  were  extensive,  leaving  more  than  8.5  million 
customers  without  power,  causing  widespread  flooding  throughout  the 
region  and  contributing  to  acute  fuel  shortages  in  parts  of  New  York  and 
New  Jersey.  The  storm  damaged  or  destroyed  hundreds  of  thousands  of 
homes,  caused  tens  of  billions  of  dollars  in  damages,  and  killed  at  least 
162  people  in  the  United  States. 151 

The  Federal  Emergency  Management  Agency  (FEMA)  coordinated  a 
large-scale  Federal  response  that  contributed  to  the  integrated,  national 
effort  to  support  affected  states  and  communities.  In  the  days  before 
Sandy’s  landfall,  FEMA  worked  closely  with  Whole  Community 
partners — including  all  levels  of  government,  private  and  nonprofit 
sectors,  faith-based  organizations,  communities,  and  individuals — to 
prepare  for  the  storm  and  anticipate  survivor  needs.  The  Agency  pre¬ 
positioned  commodities  and  assets,  activated  response  centers,  and 
deployed  over  900  personnel  ahead  of  Sandy’s  landfall.  In  the  initial 
response  to  the  storm,  the  Agency  coordinated  with  its  partners  to  provide 
Federal  resources  and  to  develop  innovative  solutions  to  address  power 
restoration,  transportation,  fuel  distribution,  and  housing  needs.  As 
recovery  efforts  began,  FEMA  continued  to  work  with  its  partners  to  assist 
survivors  and  their  communities.  The  Agency  executed  one  of  the  largest 
deployments  of  personnel  in  its  history,  delivered  over  $1.2  billion  in 
housing  assistance  to  more  than  174,000  survivors,  and  obligated  over 
$800  million  for  debris  removal  and  infrastructure  restoration.152 


151  Craig  W.  Fugate,  Hurricane  Sandy  FEMA  After-Action  Report  (Washington,  DC:  Federal 
Emergency  Management  Agency,  2013),  iii,  http://www.fema.gov/media-library-data/20130726-1923- 
25045-7442/sandy_fema_aar.pdf. 
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On  December  9,  2012,  Mayor  Bloomberg  directed  the  Deputy  Mayor  for  Health 
and  Human  Services  and  the  Deputy  Mayor  for  Operations  to  “conduct  an  evaluation  and 
report  back  in  a  short  time  with  recommendations  on  how  the  City’s  response  capacity 
and  performance  might  be  strengthened  in  the  future.’’153  This  directive  resulted  in  a 
report  and  59  recommendations.  The  recommendations  are  reported  to  be  based  on 
“several  months  of  intensive  and  comprehensive  effort  by  City  agencies,  and  include 
input  from  many  stakeholders,  including  nonprofit  partners,  New  York  State  agencies, 
and  an  extensive  set  of  hearings  held  by  the  New  York  City  Council.”154  This  after  action 
report  is  one  of  the  reports  evaluated  for  the  purposes  of  testing  the  proposed  conceptual 
model  of  this  study. 

In  addition  to  the  aforementioned  city  after  action  report,  FEMA  completed,  in 
July  2013,  an  after  action  report  addressing  the  federal  response  measures  taken  across 
the  entire  eastern  seaboard.  According  to  the  report: 

Despite  FEMA’s  many  successes,  the  response  to  Sandy  also  revealed 
notable  challenges  in  how  FEMA  coordinates  with  its  Federal  partners, 
supports  state  and  local  officials  and  disaster  survivors,  integrates  with  the 
Whole  Community,  and  prepares  and  deploys  its  workforce.  Difficulties 
with  issuing  timely  mission  assignments,  the  implementation  of  incident 
management  structures,  and  meeting  survivor  needs  early  in  the  response 
phase  are  examples  of  challenges  that  emerged  during  Sandy. 155 

This  FEMA  after  action  report  will  also  be  evaluated  for  the  purposes  of  testing  the 
proposed  conceptual  model  of  this  study. 

These  after  action  reports  are  a  great  source  of  evaluation  in  relation  to  this 
study’s  proposed  conceptual  model  as  they  address  contrasting  government  level  incident 
management  strategies,  perspectives,  interoperability  capabilities  with  other  incident 
management  components,  and  the  general  contrasting  lexicon  applied  to  such  an  event. 
These  aspects  are  evaluated  to  determine  where  the  proposed  model  might  have  closed 


153  Linda  I.  Gibbs  and  Caswell  F.  Halloway,  NYC  Hurricane  Sandy  After  Action  Report  (New  York: 
NYC,  2013),  http://www.nyc.gOv/html/recovery/downloads/pdf/sandy_aar_5.2.13.pdf. 
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gaps,  removed  deficiencies,  provided  a  better  lens  for  evaluating  the  threat/incident,  or  is 
in  conflict. 


1.  Findings  and  Observations  in  Support  of  the  Proposed  Model 

•  In  the  FEMA  after  action  report  under  Theme  1:  Ensuring  unity  of  effort 
across  the  federal  response,  and  Theme  3:  Fostering  unity  of  effort  across 
the  whole  community,  the  following  areas  for  improvement  were 
identified,  implementing  incident  management  structures,  and 
coordinating  among  states,  localities,  and  tribes.156  This  finding  is  a  clear 
demonstration  that  the  national  incident  management  doctrine  and 
conceptual  model  in  its  current  format  is  not  effective  enough  in  its 
resonance  with  practitioners  or  in  its  implementation.  This  viewpoint 
supports  this  study’s  problem  statement  and  demonstrates  a  need  for  a 
more  intuitive  and  effective  incident  management  conceptual  model. 

•  In  the  FEMA  after  action  report  under  Theme  1:  Ensuring  unity  of  effort 
across  the  federal  response,  the  following  area  for  improvement  was 
identified,  ensuring  continuous  improvement  of  disaster  doctrine,  policies, 

1  CH 

and  plans.  This  finding  also  demonstrates  and  specifically  calls  for  an 
improvement  to  the  foundational  documents  that  create  the  existing 
national  incident  management  conceptual  model.  It  also  highlights  a 
weakness  in  making  such  improvements  and  methods  for  identifying  the 
best  principles  for  doctrinal  inclusion,  which  supports  this  study’s  problem 
statement  and  may  illustrate  some  causation. 

•  In  the  New  York  City  after  action  report,  a  glaring  deficiency  or  omission 
occurs  regarding  the  effectiveness  of  local  incident  management  practices 
or  operations.  The  after  action  report  seems  to  break  down  the  evaluation 
areas  on  specific  capabilities  or  functions  with  little  regard  for  incident 
management  as  the  overarching  framework  of  operations.158  This 
circumstance  supports  this  study’s  problem  statement  and  the  notion  that  a 
lacking  universal  understanding  of,  appreciation  for,  or  application  of 
incident  management  as  a  conceptual  metric  exists  for  evaluating 
emergency  operations.  It  also  supports  this  study’s  assertion  and 
practitioner  survey  finding  that  many  practitioners  do  not  know  or 
consider  themselves  part  of  a  larger  incident  management  enterprise. 

•  The  FEMA  after  action  reports  states: 


156  Fugate,  Hurricane  Sandy  FEMA  After-Action  Report,  iv. 

157  Ibid. 

158  Gibbs,  Halloway,  and  Caswell,  NYC  Hurricane  Sandy  After  Action  Report. 
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Until  recently,  FEMA  lacked  a  formal,  routine  process  to  track  and 
resolve  continuous  improvement  actions  across  the  Agency. 
FEMA’s  Lessons  Learned/Continuous  Improvement  Program 
(LL/CIP)  is  aimed  at  addressing  this  challenge  by  outlining 
common  processes,  tools,  and  functions  for  documenting  and 
sharing  lessons  learned  throughout  the  Agency.  As  part  of  the 
LL/CIP,  FEMA  has  established  a  FEMA  Continuous  Improvement 
Working  Group  (CIWG),  responsible  for  assigning  and  tracking 
continuous  improvement  actions  that  are  beyond  the  resolution 
capability  of  a  single  FEMA  component  or  that  have  Agency-wide 
implications.  The  FEMA  CIWG  includes  senior-level 
representation  from  FEMA  components  and  will  meet  at  least 
quarterly.  The  FEMA  CIWG  convened  its  first  meeting  on 
February  7,  2013,  and  will  monitor  and  report  on  the  progress  of 
FEMA  components  in  addressing  the  areas  for  improvement 
identified  in  this  report. 159 

This  finding  supports  the  findings  of  this  study,  and  may  serve  to  highlight 
some  of  the  causation  for  the  current  state  of  the  national  incident 
management  conceptual  model. 

•  The  FEMA  after  action  report  states: 

as  of  October  1,  2012,  FEMA  launched  a  new  FQS  that  defines  the 
training,  experience,  and  demonstrated  performance  required  to 
become  credentialed  in  each  of  the  disaster  workforce  positions. 
Because  FQS  launched  shortly  before  Sandy,  FEMA  may 
adequately  address  the  challenges  noted  above  through  planned 
activities  in  support  of  full  implementation.  However,  in  the 
interim,  Sandy  did  reveal  that  FEMA  may  lack  a  coherent  strategy 
to  address  temporary  personnel  shortfalls  in  specific  FQS 
programs,  especially  for  large-scale  events. 160 

This  finding  supports  this  study’s  conceptual  model  regarding  KSAs  and 
highlights  the  need  to  have  highly  competent  and  trained  incident 
management  practitioners. 

2.  Findings  and  Observation  not  in  Support  of  Proposed  Model 

•  The  FEMA  after  action  report  states: 

Sandy  response  operations  in  New  York  and  New  Jersey  revealed 
inconsistencies  in  the  way  FEMA  establishes  incident  management 
structures  for  large-scale  incidents.  Agency  doctrine  gives  FEMA 


159  Fugate,  Hurricane  Sandy  FEMA  After-Action  Report,  16. 

160  Ibid.,  32-33. 
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choices  of  different  organizational  structures  to  meet  the  needs  of 
an  incident.  During  response  efforts  to  Sandy,  FEMA  used  an 
organizational  structure  that  included  geographical  branches  and 
divisions  and  an  Area  Coordination  Group  responsible  for  the  two 
hardest-hit  states.  FEMA  experienced  challenges  implementing 
these  structures,  which  are  designed  for  larger  incidents.  FEMA’s 
Incident  Management  Handbook  provides  guidance  for  three 
potential  organizational  constructs  for  disaster  operations.  FEMA 
most  commonly  uses  a  functional  stmcture,  organizing  itself 
around  the  programs  that  it  delivers.  The  second  approach — a 
geographic  structure — allows  FEMA  to  organize  by  dividing  its 
staff  into  divisions  based  on  the  geography  of  the  affected  area. 

The  third  approach — a  combined  organization  structure — 
combines  functional  and  geographic  approaches.  For  Sandy, 

FEMA  chose  this  combined  organization  construct  for  response 
and  initial  recovery  activities  in  New  York  and  New  Jersey.  This 
approach  was  designed  to  facilitate  centralized  program  decision¬ 
making,  while  ensuring  appropriate  geographic  coverage.161 

While  this  finding  highlights  difficulties  in  implementing  various 
organizational  structures,  a  model  that  this  study’s  proposed  model 
discourages  recommending  instead  a  consistent  simplified  modular  model 
for  greatest  familiarity  and  practitioner  adoption,  it  proposes  a  solution 
that  does  not  seem  to  be  potent  enough.  It  recommends  simply  updating  its 
Incident  Management  Handbook  to  better  outline  command  structures.162 
This  solution  is  not  effective  or  broad  enough.  The  federal  government 
should  organize  itself  in  a  common  incident  management  organizational 
model  that  reflects  every  other  level  of  government  or  incident 
management  level  as  proposed  by  this  study. 

•  Several  of  the  FEMA  after  action  report  areas  for  improvement  highlight 
confusion  and  inefficiencies  bred  from  the  implementation  of  unfamiliar 
organizational  models.163  While  this  study’s  conceptual  model  supports 
this  area  for  improvement,  this  after  action  report  does  not  go  far  enough 
in  recommending  strong  areas  for  improvement  that  would  support  and 
endorse  static  and  familiar  organizational  models  to  improve  the 
practitioner  conceptual  adoption  and  familiarity. 

•  The  FEMA  after  action  report  states: 

as  of  October  1,  2012,  FEMA  launched  a  new  FQS  that  defines  the 
training,  experience,  and  demonstrated  performance  required  to 

161  Fugate,  Hurricane  Sandy  FEMA  After-Action  Report,  12. 

162  Ibid.,  14. 

163  Ibid.,  14-15. 
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become  credentialed  in  each  of  the  disaster  workforce  positions. 
Because  FQS  launched  shortly  before  Sandy,  FEMA  may 
adequately  address  the  challenges  noted  above  through  planned 
activities  in  support  of  full  implementation.  However,  in  the 
interim,  Sandy  did  reveal  that  FEMA  may  lack  a  coherent  strategy 
to  address  temporary  personnel  shortfalls  in  specific  FQS 
programs,  especially  for  large-scale  events.164 

While  this  statement  does  support  this  study’s  conceptual  model  regarding 
KSAs,  it  does  not  address  the  areas  of  expertise  in  alignment  with  incident 
management  enterprise  practitioners  and  the  universal  modular  approach 
recommended  by  this  study’s  model. 

•  The  New  York  City  after  action  report  is  not  organized  in  any  way  to 
reflect  or  evaluate  overall  incident  management  effectiveness. 165  This  lack 
of  organization  is  in  complete  (intentionally  or  not)  conflict  with  the  entire 
premise  of  this  study.  Events,  such  as  Hurricane  Sandy,  should  always  be 
evaluated  through  a  lens  of  incident  management  efficacy  and 
improvement. 

3.  Conclusions  regarding  the  2012  Hurricane  Sandy  Response 

Stafford  Act  events  should  be  the  events  where  current  incident  management 
models  are  best  implemented.  This  event  highlighted  with  unfortunate  gravity  how  much 
room  for  improvement,  simplification,  and  standardization  this  study’s  current  model  has. 
A  nationally  uniform,  simple,  and  intuitive  model  is  obviously  called  upon,  and  this 
study’s  proposed  conceptual  model  may  very  well  be  a  viable  part  of  that  solution. 

This  event,  like  the  others  evaluated,  served  as  a  great  example  of  the  need  for 
incident  management  concepts  to  lend  themselves  to  this  study’s  proposed  model,  and  the 
need  to  understand  and  apply  an  incident  management  model  that  encapsulates 
components  from  the  local  to  the  international  level.  While  many  of  the  strategies  and 
concepts  of  the  two  after  action  reports  were  valid  and  will  serve  to  improve  or 
complement  the  current  incident  management  capability,  obvious  examples  of  inherent 
confusion,  areas  of  conflict,  or  areas  of  lacking  clarity  do  appear.  Stafford  Act  events  like 
the  2012  Hurricane  Sandy  disaster,  and  indeed  all  events  or  incidents,  would  be  well 
served  by  a  model  that  is  universal  in  its  approach  to  incident  types  and  governmental 


164  FUgate,  Hurricane  Sandy  FEMA  After-Action  Report,  32-33. 
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levels.  If  this  study’s  model  were  applied  nationally  (or  internationally)  it  would  surely 
serve  to  improve  response  efficacy,  practitioner  understanding,  and  interoperability  and 
collaboration  amongst  agencies.  This  event  is  a  shining  example  that  incident 
management  practitioners  of  any  type  should  not  have  to  shift  their  paradigms  based  on 
the  event. 
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